From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 17072 invoked by alias); 22 Jul 2015 13:48:19 -0000 Mailing-List: contact zsh-workers-help@zsh.org; run by ezmlm Precedence: bulk X-No-Archive: yes List-Id: Zsh Workers List List-Post: List-Help: X-Seq: 35854 Received: (qmail 29655 invoked from network); 22 Jul 2015 13:48:17 -0000 X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on f.primenet.com.au X-Spam-Level: X-Spam-Status: No, score=-6.9 required=5.0 tests=BAYES_00,RCVD_IN_DNSWL_HI, RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL,SPF_HELO_PASS autolearn=ham autolearn_force=no version=3.4.0 X-AuditID: cbfec7f4-f79c56d0000012ee-93-55af9cbea06a Date: Wed, 22 Jul 2015 14:38:03 +0100 From: Peter Stephenson To: zsh-workers@zsh.org Subject: Re: infinite recursion in ihungetc() Message-id: <20150722143803.1be07f1e@pwslap01u.europe.root.pri> In-reply-to: <2874073.clZcYqQZLr@kdudka.brq.redhat.com> References: <2874073.clZcYqQZLr@kdudka.brq.redhat.com> Organization: Samsung Cambridge Solution Centre X-Mailer: Claws Mail 3.7.9 (GTK+ 2.22.0; i386-redhat-linux-gnu) MIME-version: 1.0 Content-type: text/plain; charset=US-ASCII Content-transfer-encoding: 7bit X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFjrMLMWRmVeSWpSXmKPExsVy+t/xy7r75qwPNZgxQc3iYPNDJgdGj1UH PzAFMEZx2aSk5mSWpRbp2yVwZTw9+Zyx4CZfxaw72xkbGLdzdzFyckgImEjsvTGVFcIWk7hw bz1bFyMXh5DAUkaJ9z9eQTkzmCSuHLrDCuFsY5SY3/wJyOHgYBFQlVjYLAbSzSZgKDF102xG EFtEQFzi7NrzLCC2sICuxPnXS9lBbF4Be4kpt84zg9icAuYSqxddYQKxhQTMJPaeec0GYvML 6Etc/fuJCeIie4mZV84wQvQKSvyYfA9sJrOAlsTmbU2sELa8xOY1b5kh5qhL3Li7m30Co9As JC2zkLTMQtKygJF5FaNoamlyQXFSeq6hXnFibnFpXrpecn7uJkZI0H7Zwbj4mNUhRgEORiUe 3glH14UKsSaWFVfmHmKU4GBWEuH1nbo+VIg3JbGyKrUoP76oNCe1+BCjNAeLkjjv3F3vQ4QE 0hNLUrNTUwtSi2CyTBycUg2MIoL8mnbK1Qy7DKTOTpBuXSd1+MUsbuHdndqLgoO3CCyX7rQ/ 7yi3MHnS/fbZF3WPu8rHLX/Q9ebBAjb9r7KnZJx8Tkm8Slr+R9fYculXu2XqijFiVzas7Qv+ 8rY24vmDoLgdMy5tvsTlMCNAR/nBm4od348EsbKe/Gy1KTzQ4JpFyKdT6/fkKLEUZyQaajEX FScCAB1SY29WAgAA On Wed, 22 Jul 2015 13:45:06 +0200 Kamil Dudka wrote: > Fedora Analysis Framework captured 10 crashes of zsh-5.0.8 due to infinite > recursion in ihungetc(): > > https://retrace.fedoraproject.org/faf/reports/717794/ > > The infinite recursion happens at this line: > > http://repo.or.cz/w/zsh/mirror.git/blob/a0862f63:/Src/hist.c#l908 > > The 'hungetc' code pointer is obviously set to ihungetc() itself. We do > not have full bakctrace of the crash but shouldn't there be any condition > to actually stop the recursion when the conditions at lines 906-907 are > true and hungetc points at ihungetc()? > > There is no single command that could invalidate any of the conditions > after nesting deeper into the recursion... Yes, it should be straightforward to prevent, although this code isn't particularly transparent (or new), so I don't know how you could get there. pws diff --git a/Src/hist.c b/Src/hist.c index 6725313..cf224cb 100644 --- a/Src/hist.c +++ b/Src/hist.c @@ -136,6 +136,7 @@ mod_export int hist_skip_flags; #define HA_NOINC (1<<1) /* Don't store, curhist not incremented */ #define HA_INWORD (1<<2) /* We're inside a word, don't add start and end markers */ +#define HA_UNGET (1<<3) /* Recursively ungetting */ /* Array of word beginnings and endings in current history line. */ @@ -904,8 +905,13 @@ ihungetc(int c) while (!lexstop && !errflag) { if (hptr[-1] != (char) c && stophist < 4 && - hptr > chline + 1 && hptr[-1] == '\n' && hptr[-2] == '\\') - hungetc('\n'), hungetc('\\'); + hptr > chline + 1 && hptr[-1] == '\n' && hptr[-2] == '\\' && + !(histactive & HA_UNGET)) { + histactive |= HA_UNGET; + hungetc('\n'); + hungetc('\\'); + histactive &= ~HA_UNGET; + } if (expanding) { zlemetacs--;