segfault in 4.1.1-test-2 with ${(u)${=:-$(echo yes yes)}}

segfault in 4.1.1-test-2 with ${(u)${=:-$(echo yes yes)}}

[Anthony Heading]

Hi,

Subject says it all really.  sparc-sun-solaris2.8 / gcc 3.3

Please let me know if you want me to investigate further.

Regards

Anthony

This communication is for informational purposes only.  It is not intended as
an offer or solicitation for the purchase or sale of any financial instrument
or as an official confirmation of any transaction. All market prices, data
and other information are not warranted as to completeness or accuracy and
are subject to change without notice. Any comments or statements made herein
do not necessarily reflect those of J.P. Morgan Chase & Co., its
subsidiaries and affiliates.

Re: segfault in 4.1.1-test-2 with ${(u)${=:-$(echo yes yes)}}

[Peter Stephenson]

I could add comments about this, but why start now?  The whole of
paramsubst() needs to be something else entirely.

I *hate* that function.

Index: Src/subst.c
===================================================================
RCS file: /cvsroot/zsh/zsh/Src/subst.c,v
retrieving revision 1.32
diff -u -r1.32 subst.c
--- Src/subst.c	7 May 2003 09:38:53 -0000	1.32
+++ Src/subst.c	21 May 2003 15:59:49 -0000
@@ -1951,24 +1951,31 @@
 	int i;
 	LinkNode on = n;
 
-	if (!aval[0] && !plan9) {
+	if (unique) {
+	    if(!copied)
+		aval = arrdup(aval);
+
+	    i = arrlen(aval);
+	    if (i > 1)
+		zhuniqarray(aval);
+	}
+	if ((!aval[0] || !aval[1]) && !plan9) {
+	    int vallen;
 	    if (aptr > (char *) getdata(n) &&
 		aptr[-1] == Dnull && *fstr == Dnull)
 		*--aptr = '\0', fstr++;
-	    y = (char *) hcalloc((aptr - ostr) + strlen(fstr) + 1);
+	    vallen = aval[0] ? strlen(aval[0]) : 0;
+	    y = (char *) hcalloc((aptr - ostr) + vallen + strlen(fstr) + 1);
 	    strcpy(y, ostr);
 	    *str = y + (aptr - ostr);
+	    if (vallen)
+	    {
+		strcpy(*str, aval[0]);
+		*str += vallen;
+	    }
 	    strcpy(*str, fstr);
 	    setdata(n, y);
 	    return n;
-	}
-	if (unique) {
-	    if(!copied)
-		aval = arrdup(aval);
-
-	    i = arrlen(aval);
-	    if (i > 1)
-		zhuniqarray(aval);
 	}
 	if (sortit) {
 	    if (!copied)
Index: Test/D04parameter.ztst
===================================================================
RCS file: /cvsroot/zsh/zsh/Test/D04parameter.ztst,v
retrieving revision 1.8
diff -u -r1.8 D04parameter.ztst
--- Test/D04parameter.ztst	7 May 2003 09:38:53 -0000	1.8
+++ Test/D04parameter.ztst	21 May 2003 15:59:49 -0000
@@ -589,3 +589,13 @@
 0:Parameters associated with (#m) flag
 >MATCH 16 20 MATCH
 >5
+
+  print -l JAMES${(u)${=:-$(echo yes yes)}}JOYCE
+  print -l JAMES${(u)${=:-$(echo yes yes she said yes i will yes)}}JOYCE
+0:Bug with (u) flag reducing arrays to one element
+>JAMESyesJOYCE
+>JAMESyes
+>she
+>said
+>i
+>willJOYCE

-- 
Peter Stephenson <pws@csr.com>                  Software Engineer
CSR Ltd., Science Park, Milton Road,
Cambridge, CB4 0WH, UK                          Tel: +44 (0)1223 692070


**********************************************************************
The information transmitted is intended only for the person or
entity to which it is addressed and may contain confidential 
and/or privileged material. 
Any review, retransmission, dissemination or other use of, or
taking of any action in reliance upon, this information by 
persons or entities other than the intended recipient is 
prohibited.  
If you received this in error, please contact the sender and 
delete the material from any computer.
**********************************************************************

Re: segfault in 4.1.1-test-2 [now with a different param expansion]

[Anthony Heading]

On Wed, May 21, 2003 at 05:03:39PM +0100, Peter Stephenson wrote:
> I *hate* that function.

Heh. For me, even the manual page is more than enough.  So thanks!

Since the iron is hot, however...  see below  :-)

I'm probably missing something obvious here - At the point of the fault,
parameter 'a' of nstrpcmp is null, however it looks to me like it's
outside the range of the qsort??!  Maybe I don't believe the
debugger. Anyhow, both gcc 3.3 and Sun C v5 show the same behaviour,
but I couldn't reproduce the fault on Linux.  Also, though
the implications seem a bit odd, overriding qsort using
LD_PRELOAD seems to avoid the crash.

Again, let me know if I should to do more investigation.

Regards

Anthony


========================================================

fires-02% gdb Src/zsh
GNU gdb 5.3
Copyright 2002 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "sparc-sun-solaris2.8"...
(gdb) run
Starting program: /tmp/zsh-4.1.1-test-2/Src/zsh 
fires-02% cd /tmp
fires-02% cat numbers
22829
29156
15632
19174
4296
10392
5297
6392
19035
24181
2494
20468
20513
14808
26229
fires-02% x=($(<numbers))
fires-02% echo ${(no)x}

Program received signal SIGSEGV, Segmentation fault.
0xff15c1b0 in __strcoll_std () from /usr/lib/libc.so.1
(gdb) where
#0  0xff15c1b0 in __strcoll_std () from /usr/lib/libc.so.1
#1  0x000a86b4 in nstrpcmp (a=0xff1e01dc, b=0xff1e01ec) at subst.c:550
#2  0xff14b07c in qsort () from /usr/lib/libc.so.1
#3  0x000af434 in paramsubst (l=0xff1e01a8, n=0xff1e01bc, str=0xffbed71c, qt=0, ssub=0) at subst.c:1991
#4  0x000a69b4 in stringsubst (list=0xff1e01a8, node=0xff1e01bc, ssub=0, asssub=0) at subst.c:137
#5  0x000a61d0 in prefork (list=0xff1e01a8, flags=1) at subst.c:74
#6  0x000331dc in execcmd (state=0xffbedc48, input=0, output=0, how=18, last1=2) at exec.c:1796
#7  0x00030cb0 in execpline2 (state=0xffbedc48, pcode=323, how=18, input=0, output=0, last1=0) at exec.c:1228
#8  0x0002fa78 in execpline (state=0xffbedc48, slcode=4098, how=18, last1=0) at exec.c:1018
#9  0x0002eec0 in execlist (state=0xffbedc48, dont_change_job=0, exiting=0) at exec.c:829
#10 0x0002e9d8 in execode (p=0xff1e0150, dont_change_job=0, exiting=0) at exec.c:730
#11 0x000545d4 in loop (toplevel=1, justonce=0) at init.c:167
#12 0x000587b4 in zsh_main (argc=1, argv=0xffbede54) at init.c:1239
#13 0x0001273c in main (argc=1, argv=0xffbede54) at main.c:37
(gdb) frame 3
#3  0x000af4d4 in paramsubst (l=0xff1e05a8, n=0xff1e05bc, str=0xffbed71c, qt=0, ssub=0) at subst.c:1998
1998                        qsort(aval, i, sizeof(char *), sortfn[sortit-1]);
(gdb) print aval
$32 = (char **) 0xff1e05e0
(gdb) print i
$33 = 15
(gdb) 


This communication is for informational purposes only.  It is not intended as
an offer or solicitation for the purchase or sale of any financial instrument
or as an official confirmation of any transaction. All market prices, data
and other information are not warranted as to completeness or accuracy and
are subject to change without notice. Any comments or statements made herein
do not necessarily reflect those of J.P. Morgan Chase & Co., its
subsidiaries and affiliates.

Re: segfault in 4.1.1-test-2 [now with a different param expansion]

[Peter Stephenson]

Anthony Heading wrote:
> I'm probably missing something obvious here - At the point of the fault,
> parameter 'a' of nstrpcmp is null, however it looks to me like it's
> outside the range of the qsort??!

Aha, that's because you don't appreciate the power of zsh's
NoCommentNeeded(TM) Technology.

There was a subtle error in the comparison function which could result
in fairly arbitrary unpleasantness.

Index: Src/subst.c
===================================================================
RCS file: /cvsroot/zsh/zsh/Src/subst.c,v
retrieving revision 1.33
diff -u -r1.33 subst.c
--- Src/subst.c	21 May 2003 16:21:01 -0000	1.33
+++ Src/subst.c	22 May 2003 10:05:05 -0000
@@ -554,7 +554,7 @@
     cmp = (int)STOUC(*c) - (int)STOUC(*d);
 #endif
     if (idigit(*c) || idigit(*d)) {
-	for (; c > *(char **)b && idigit(c[-1]); c--, d--);
+	for (; c > *(char **)a && idigit(c[-1]); c--, d--);
 	if (idigit(*c) && idigit(*d)) {
 	    while (*c == '0')
 		c++;

-- 
Peter Stephenson <pws@csr.com>                  Software Engineer
CSR Ltd., Science Park, Milton Road,
Cambridge, CB4 0WH, UK                          Tel: +44 (0)1223 692070


**********************************************************************
The information transmitted is intended only for the person or
entity to which it is addressed and may contain confidential 
and/or privileged material. 
Any review, retransmission, dissemination or other use of, or
taking of any action in reliance upon, this information by 
persons or entities other than the intended recipient is 
prohibited.  
If you received this in error, please contact the sender and 
delete the material from any computer.
**********************************************************************