Core dump bug in ZSH version 3.0.7

Core dump bug in ZSH version 3.0.7

[Carl Feynman]

I accidentally pasted a python program into zsh and it crashed it, 
saying "Memory fault (core dumped)".  I cut down the offending python 
code to the following three lines, all of which seem to be required to 
cause the bug:

if (len(sys.argv) > 1) :
mask = (1 << string.atoi(sys.argv[1])) - 1
key = string.atoi(sys.argv[2])

When I put these lines in a file, I can crash zsh by either 'zsh 
bad-file' or, from within zsh, '. bad-file'.  In both cases it prints

command not found: len(sys.argv) [1]
parse error near `)' [2]
Memory fault (core dumped)

This is happening in zsh version 3.0.7.  Uname -a returns

Linux aleph 2.2.16-3 #1 Mon Jun 19 19:11:44 EDT 2000 i686 unknown

--Carl Feynman
Ab Initio Software Corporation

Re: Core dump bug in ZSH version 3.0.7

[Bart Schaefer]

On Nov 12,  1:28pm, Carl Feynman wrote:
}
} I cut down the offending python code to the following three lines, all
} of which seem to be required to cause the bug:
} 
} if (len(sys.argv) > 1) :
} mask = (1 << string.atoi(sys.argv[1])) - 1
} key = string.atoi(sys.argv[2])

I can reproduce it with just the last two of those lines.

It doesn't crash 4.0.x/4.1.x, but it does get into a rather strange state,
trying to read a here-document whose start/end string is a single space,
which of course is impossible (so you're trapped in the here-document until
you interrupt somehow).

zagzig% mask = (1 << string.atoi(sys.argv[1])) - 1
zsh: parse error near `)'
zagzig% key = string.atoi(sys.argv[2])
heredoc>  


-- 
Bart Schaefer                                 Brass Lantern Enterprises
http://www.well.com/user/barts              http://www.brasslantern.com

Zsh: http://www.zsh.org | PHPerl Project: http://phperl.sourceforge.net   

PATCH (4.0.x, 4.1.x): Re: Core dump bug in ZSH version 3.0.7

[Bart Schaefer]

On Nov 12,  6:59pm, Bart Schaefer wrote:
} Subject: Re: Core dump bug in ZSH version 3.0.7
}
} It doesn't crash 4.0.x/4.1.x, but it does get into a rather strange state,
} trying to read a here-document whose start/end string is a single space,
} which of course is impossible (so you're trapped in the here-document until
} you interrupt somehow).
} 
} zagzig% mask = (1 << string.atoi(sys.argv[1])) - 1
} zsh: parse error near `)'

At this point we've parsed this as the command "mask" with arguments "="
and "(1" and with here-document ending at "string.atoi(sys.argv[1])"; the
parse error is at the second parenthesis.

However, when zsh bailed out with the parse error, it failed to pop the
pending here-document off the queue of such documents.  So then when it
begins parsing this:

} zagzig% key = string.atoi(sys.argv[2])
} heredoc>  

Zsh now believes it is accepting input for the here-document started at
the previous command line.  4.0+ doesn't crash because it re-uses the
memory at which the here-document's name is pointing, so the document
merely seems to have a bogus name; 3.0.x crashes because the name pointer
in the here-document structure has become garbage.

The solution seems to be the following; I haven't checked whether it will
apply directly to 3.0.x, as this patch is based on 4.1.0-dev-2:

Index: Src/parse.c
===================================================================
--- Src/parse.c	2001/09/05 15:22:33	1.10
+++ Src/parse.c	2001/11/13 18:10:10
@@ -481,6 +481,11 @@
 	    return 0;
 	}
 	yyerror(1);
+	while (hdocs) {
+	    struct heredocs *next = hdocs->next;
+	    zfree(hdocs, sizeof(struct heredocs));
+	    hdocs = next;
+	}
 	herrflush();
 	if (noerrs != 2)
 	    errflag = 1;

-- 
Bart Schaefer                                 Brass Lantern Enterprises
http://www.well.com/user/barts              http://www.brasslantern.com

Zsh: http://www.zsh.org | PHPerl Project: http://phperl.sourceforge.net