Re: [BUG] Two vulnerabilities in zsh

[Daniel Shahaf <d.s@daniel.shahaf.name>]

Peter Stephenson wrote on Fri, 22 May 2020 19:56 +0100:
> I believe inlined patches work from this version of Evolution...

Yes, they applied fine.  Thanks.  More below.

Peter Stephenson wrote on Fri, 22 May 2020 22:47 +0100:
> +++ b/Test/D04parameter.ztst
> @@ -2662,7 +2662,25 @@ F:behavior, see http://austingroupbugs.net/view.php?id=888
> -# Temporarily using the 'D' flag because it generates a "BUG:" message in
> -# debug builds only.
>   $ZTST_testdir/../Src/zsh -fc $'$\\\n('
> -1Df:regression test for workers/45843#2: escaped newline in command substitution start token
> +1f:regression test for workers/45843#2: escaped newline in command substitution start token
> +?(eval):1: parse error near `$('
> +

Note that you haven't removed the 'f' flag, which implies that this
test's $?/output/errput don't match the expected ones.  The 'f' flag
should be removed and the expected errput updated:

-(eval):1: parse error near `$('
+zsh:2: parse error near `$('

(That's copied from the output of «make check» after removing the 'f' flag.)

> + eval $'echo $\\\n(printf "%d\\n" $(( 4 + 2 )) )'
> +0:Normal command substitution with escaped newline
> +>6  

This test fails on my machine:

--- /tmp/zsh.ztst.24422/ztst.out        2020-05-23 02:11:04.239080323 +0000                                                                                                                                         
+++ /tmp/zsh.ztst.24422/ztst.tout       2020-05-23 02:11:04.239080323 +0000
@@ -1 +1 @@
-6  
+6
Test /home/daniel/src/zsh/./Test/D04parameter.ztst failed: output differs from expected as shown above for:
 eval $'echo $\\\n(printf "%d\\n" $(( 4 + 2 )) )'
Was testing: Normal command substitution with escaped newline

The difference is two trailing spaces in the expected output that are missing from the actual output.

The other new tests seem to have the same issue.

Thanks,

Daniel