Zsh parser segmentation fault in putpromptchar putpromptchar at prompt.c

Zsh parser segmentation fault in putpromptchar putpromptchar at prompt.c

[Eduardo Bustamante]

[-- Attachment #1: Type: text/plain, Size: 2234 bytes --]

dualbus@debian:~/bash-fuzzing/zsh-parser$ base64 segfault
JHsoJVUpWS0lKHZ9

dualbus@debian:~/bash-fuzzing/zsh-parser$ md5sum segfault
0d79a8c613315f32a453d5aa07a7de65  segfault

dualbus@debian:~/bash-fuzzing/zsh-parser$ cat -v segfault
${(%U)Y-%(v}

(gdb) r -n segfault
Starting program: /home/dualbus/src/zsh/zsh/Src/zsh -n segfault
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".

Program received signal SIGSEGV, Segmentation fault.
0x00000000004aab3e in putpromptchar (doprint=1, endchar=0,
txtchangep=0x0) at prompt.c:403
403                             if (*psvar[(arg ? arg : 1) - 1])
(gdb) bt
#0  0x00000000004aab3e in putpromptchar (doprint=1, endchar=0,
txtchangep=0x0) at prompt.c:403
#1  0x00000000004aa170 in promptexpand (s=0x7ffff7e5b3f8 "%(V", ns=0,
rs=0x0, Rs=0x0, txtchangep=0x0) at prompt.c:215
#2  0x00000000004bd792 in paramsubst (l=0x7fffffffbfa0,
n=0x7ffff7e5b3d8, str=0x7fffffffb950, qt=0, pf_flags=0,
    ret_flags=0x7fffffffbf2c) at subst.c:3589
#3  0x00000000004b4fe3 in stringsubst (list=0x7fffffffbfa0,
node=0x7ffff7e5b3d8, pf_flags=0, ret_flags=0x7fffffffbf2c, asssub=0)
    at subst.c:247
#4  0x00000000004b4395 in prefork (list=0x7fffffffbfa0, flags=0,
ret_flags=0x7fffffffbf2c) at subst.c:85
#5  0x0000000000440df5 in execcmd_getargs (preargs=0x7ffff7e5b3c0,
args=0x7ffff7e5b380, expand=1) at exec.c:2659
#6  0x000000000043c1eb in execcmd_exec (state=0x7fffffffde40,
eparams=0x7fffffffcd00, input=0, output=0, how=18, last1=2)
    at exec.c:2765
#7  0x000000000043b804 in execpline2 (state=0x7fffffffde40, pcode=131,
how=18, input=0, output=0, last1=0) at exec.c:1873
#8  0x0000000000433f6e in execpline (state=0x7fffffffde40,
slcode=3074, how=18, last1=0) at exec.c:1602
#9  0x0000000000432dfe in execlist (state=0x7fffffffde40,
dont_change_job=0, exiting=0) at exec.c:1360
#10 0x000000000043277e in execode (p=0x7ffff7e5b320,
dont_change_job=0, exiting=0, context=0x4d9174 "toplevel") at
exec.c:1141
#11 0x000000000045e366 in loop (toplevel=1, justonce=0) at init.c:208
#12 0x00000000004627d6 in zsh_main (argc=3, argv=0x7fffffffe468) at init.c:1692
#13 0x0000000000411a32 in main (argc=3, argv=0x7fffffffe468) at ./main.c:93

[-- Attachment #2: segfault --]
[-- Type: application/octet-stream, Size: 12 bytes --]

${(%U)Y-%(v}

Re: Zsh parser segmentation fault in putpromptchar putpromptchar at prompt.c

[Peter Stephenson]

On Mon, 8 May 2017 13:42:46 -0500
Eduardo Bustamante <dualbus@gmail.com> wrote:
> dualbus@debian:~/bash-fuzzing/zsh-parser$ base64 segfault
> JHsoJVUpWS0lKHZ9
> 
> dualbus@debian:~/bash-fuzzing/zsh-parser$ md5sum segfault
> 0d79a8c613315f32a453d5aa07a7de65  segfault
> 
> dualbus@debian:~/bash-fuzzing/zsh-parser$ cat -v segfault
> ${(%U)Y-%(v}

The test for psvar is wrong if it's empty.

pws

diff --git a/Src/prompt.c b/Src/prompt.c
index 29e006e..c478e69 100644
--- a/Src/prompt.c
+++ b/Src/prompt.c
@@ -399,7 +399,7 @@ putpromptchar(int doprint, int endchar, unsigned int *txtchangep)
 			test = 1;
 		    break;
 		case 'V':
-		    if (arrlen_ge(psvar, arg)) {
+		    if (psvar && *psvar && arrlen_ge(psvar, arg)) {
 			if (*psvar[(arg ? arg : 1) - 1])
 			    test = 1;
 		    }
diff --git a/Test/D01prompt.ztst b/Test/D01prompt.ztst
index 0818728..11f18dc 100644
--- a/Test/D01prompt.ztst
+++ b/Test/D01prompt.ztst
@@ -209,3 +209,7 @@
  print -P -f '%%Sfoo%%s\n' bar
 0:print -P -f
 >%Sfoo%s
+
+  print ${(%U)Y-%(v}
+0:Regression test for test on empty psvar
+>