free() error on simple input scripts

[Dennis Felsing <dennis@felsin9.de>]

[-- Attachment #1: Type: text/plain, Size: 2023 bytes --]

Hello,

Simply running zsh (from git) on each of the two attached files causes a
free() error for me:

*** Error in `/usr/local/bin/zsh': free(): invalid next size (fast): 0x00000000009708c0 ***

This has been found fuzzing using AFL: http://lcamtuf.coredump.cx/afl/

Dennis

gdb output:

Program received signal SIGABRT, Aborted.
0x00007ffff6eeb5e7 in raise () from /lib64/libc.so.6
(gdb) bt
#0  0x00007ffff6eeb5e7 in raise () from /lib64/libc.so.6
#1  0x00007ffff6eec9c8 in abort () from /lib64/libc.so.6
#2  0x00007ffff6f2a0d4 in __libc_message () from /lib64/libc.so.6
#3  0x00007ffff6f2f9fe in malloc_printerr () from /lib64/libc.so.6
#4  0x00007ffff6f30716 in _int_free () from /lib64/libc.so.6
#5  0x00000000006fccfd in unmeta (file_name=0x7fffffffc1d0 "/media/intel/vtune_amplifier_xe_2011/bin64/d\203")
    at utils.c:4238
#6  0x0000000000473137 in iscom (s=0x7fffffffc1d0 "/media/intel/vtune_amplifier_xe_2011/bin64/d\203")
    at exec.c:824
#7  hashcmd (arg0=0x7ffff7ff3560 "d\203", pp=0x969168, pp@entry=0x969160) at exec.c:878
#8  0x0000000000489575 in execcmd (state=0x7fffffffd820, input=0, output=0, how=<optimized out>, last1=2)
    at exec.c:2886
#9  0x000000000049059e in execpline2 (state=0x7fffffffd820, pcode=16729, pcode@entry=131, how=18, input=0, 
    output=0, last1=5798544, last1@entry=0) at exec.c:1698
#10 0x0000000000491294 in execpline (state=state@entry=0x7fffffffd820, slcode=<optimized out>, 
    how=how@entry=18, last1=<optimized out>) at exec.c:1485
#11 0x00000000004952ab in execlist (state=state@entry=0x7fffffffd820, dont_change_job=dont_change_job@entry=0, 
    exiting=exiting@entry=0) at exec.c:1268
#12 0x0000000000495ce7 in execode (p=0x7ffff7ff33f0, dont_change_job=0, exiting=0, context=0x72a141 "toplevel")
    at exec.c:1074
#13 0x0000000000515861 in loop (toplevel=1, justonce=0) at init.c:185
#14 zsh_main (argc=<optimized out>, argv=<optimized out>) at init.c:1649
#15 0x00007ffff6ed7dc5 in __libc_start_main () from /lib64/libc.so.6
#16 0x0000000000413829 in _start ()

[-- Attachment #2: id:000000,sig:06,src:000000,op:havoc,rep:16 --]
[-- Type: application/octet-stream, Size: 26 bytes --]

[-- Attachment #3: id:000001,sig:06,src:000002,op:havoc,rep:8 --]
[-- Type: application/octet-stream, Size: 7 bytes --]