Re: [MAYBE BUG] resetting `$0' in sourced script causes zsh to crash on Debian

[Mikael Magnusson <mikachu@gmail.com>]

2009/11/6 Dan Nelson <dnelson@allantgroup.com>:
> In the last episode (Nov 06), Stefano Lattarini said:
>> I have recently found a problem in resetting `$0' inside a script
>> "sourced" with the `.' builtin.
>>
>> Not sure if it's a bug or if it's just me doing something that should not
>> be done; hopefully you can tell.
>>
>> Here are some minimal examples exposing the problem:
>>
>>   $ cat main2.zsh
>>   . ./inc2.zsh
>>   echo 0="$0"'
>>   echo v="$v"
>>
>>   $ cat inc2.zsh
>>   0=x
>>   v=$0
>>
>>   $ zsh main2.zsh; echo e=$?  # this causes zsh to crash
>>   *** glibc detected *** zsh: double free or corruption (!prev): 0x08d91a18 ***
>
> Here's valgrind output on a FreeBSD box:
>
> 0=main2.zsh
> v=x

Are you sure? I get
2:4: unmatched '

If you modify the script you should say so. That said, I get the crash
both with and without the extraneous quote, and your output with the
quote removed. If you get that output with it left, something is
really really strange though.

With MALLOC_CHECK_ set to show errors, I get the slightly more useful
*** glibc detected *** zsh: free(): invalid pointer: 0x08102c90 ***
(than the "double free or corruption")
With MALLOC_CHECK_ set to ignore errors, I get the output as under valgrind.

My valgrind output has line numbers so I'll include it too.

==1260== Invalid read of size 1
==1260==    at 0x8063D84: bin_dot (builtin.c:4771)
==1260==    by 0x8055D9F: execbuiltin (builtin.c:439)
==1260==    by 0x8070836: execcmd (exec.c:3104)
==1260==    by 0x806C4CB: execpline2 (exec.c:1579)
==1260==    by 0x806B8DD: execpline (exec.c:1364)
==1260==    by 0x806B14B: execlist (exec.c:1161)
==1260==    by 0x806ABE2: execode (exec.c:988)
==1260==    by 0x8084761: loop (init.c:185)
==1260==    by 0x8087322: zsh_main (init.c:1454)
==1260==    by 0x80553D5: main (main.c:93)
==1260==  Address 0x40a5fb9 is 1 bytes inside a block of size 11 free'd
==1260==    at 0x40071EA: free (in
/usr/lib/valgrind/vgpreload_memcheck-x86-linux.so)
==1260==    by 0x8098BBB: zsfree (mem.c:1508)
==1260==    by 0x80A809C: strvarsetfn (params.c:3215)
==1260==    by 0x80A535B: setstrvalue (params.c:2227)
==1260==    by 0x80A686D: assignsparam (params.c:2647)
==1260==    by 0x806D85A: addvars (exec.c:2136)
==1260==    by 0x806ACBD: execsimple (exec.c:1015)
==1260==    by 0x806B00E: execlist (exec.c:1129)
==1260==    by 0x806ABE2: execode (exec.c:988)
==1260==    by 0x8084761: loop (init.c:185)
==1260==    by 0x8086630: source (init.c:1156)
==1260==    by 0x8063D6E: bin_dot (builtin.c:4768)
==1260==
==1260== Invalid free() / delete / delete[]
==1260==    at 0x40071EA: free (in
/usr/lib/valgrind/vgpreload_memcheck-x86-linux.so)
==1260==    by 0x8098BBB: zsfree (mem.c:1508)
==1260==    by 0x8063EFE: bin_dot (builtin.c:4801)
==1260==    by 0x8055D9F: execbuiltin (builtin.c:439)
==1260==    by 0x8070836: execcmd (exec.c:3104)
==1260==    by 0x806C4CB: execpline2 (exec.c:1579)
==1260==    by 0x806B8DD: execpline (exec.c:1364)
==1260==    by 0x806B14B: execlist (exec.c:1161)
==1260==    by 0x806ABE2: execode (exec.c:988)
==1260==    by 0x8084761: loop (init.c:185)
==1260==    by 0x8087322: zsh_main (init.c:1454)
==1260==    by 0x80553D5: main (main.c:93)
==1260==  Address 0x40a5fb8 is 0 bytes inside a block of size 11 free'd
==1260==    at 0x40071EA: free (in
/usr/lib/valgrind/vgpreload_memcheck-x86-linux.so)
==1260==    by 0x8098BBB: zsfree (mem.c:1508)
==1260==    by 0x80A809C: strvarsetfn (params.c:3215)
==1260==    by 0x80A535B: setstrvalue (params.c:2227)
==1260==    by 0x80A686D: assignsparam (params.c:2647)
==1260==    by 0x806D85A: addvars (exec.c:2136)
==1260==    by 0x806ACBD: execsimple (exec.c:1015)
==1260==    by 0x806B00E: execlist (exec.c:1129)
==1260==    by 0x806ABE2: execode (exec.c:988)
==1260==    by 0x8084761: loop (init.c:185)
==1260==    by 0x8086630: source (init.c:1156)
==1260==    by 0x8063D6E: bin_dot (builtin.c:4768)
==1260==
2:4: unmatched '

line 4771 for that invalid read is
ret = source(arg0);
and line 4768 is
else if (arg0[1] == '.' && arg0 + 2 == s)

(Doesn't it seem like valgrind confused these two? Or am I really
stupid? 4771 is the one calling source, yet the backtrace says it is
called by 4768. I don't think I changed that file since compiling last
time, but maybe I have.)

-- 
Mikael Magnusson