[PATCH] fix unmeta_one() (double counting Meta)

[PATCH] fix unmeta_one() (double counting Meta)

[Jun T.]

unmeta_one() (in utils.c) seems to have a simple problem.
It calls mb_metacharlenconv_r(), whose return value already
includes the number of extra bytes for Meta. So taking
account of them at lines 4814-4819 makes the value of '*sz'
too large.

This leads to the following segfalut:

% zsh -f
% autoload -Uz compinit; compinit
% zstyle ':completion:*' matcher-list 'm:{a-z}={A-Z}'
You may use any matcher you like. Then
% ls い<TAB><TAB>      # い = U+3044, UTF-8: e3 81 84
hitting tab one or two times and the zsh crashes.

The segfalut is in cfp_matcher_pats(), at computil.c:4488;
the pointer mp has an invalid value.

When unmeta_one(tmp, &cl) is called at line 4496,
    tmp = add = metafy(い) = 0xe3 0x81 0x83 0xa4.
But unmeta_one(tmp, &cl) sets cl to 5, not 4, and the
variable tl becomes negative. Thus the loop doesn't
terminate until it crashes.


diff --git a/Src/utils.c b/Src/utils.c
index 9701ea7..ea4b34b 100644
--- a/Src/utils.c
+++ b/Src/utils.c
@@ -4797,7 +4797,6 @@ unmeta_one(const char *in, int *sz)
     convchar_t wc;
     int newsz;
 #ifdef MULTIBYTE_SUPPORT
-    int ulen;
     mbstate_t wstate;
 #endif
 
@@ -4810,13 +4809,7 @@ unmeta_one(const char *in, int *sz)
 
 #ifdef MULTIBYTE_SUPPORT
     memset(&wstate, 0, sizeof(wstate));
-    ulen = mb_metacharlenconv_r(in, &wc, &wstate);
-    while (ulen-- > 0) {
-	if (in[*sz] == Meta)
-	    *sz += 2;
-	else
-	    *sz += 1;
-    }
+    *sz = mb_metacharlenconv_r(in, &wc, &wstate);
 #else
     if (in[0] == Meta) {
       *sz = 2;