core dump on parameter completion

core dump on parameter completion

[Naoki Wakamatsu]

3.1.6-test-2 generates core file on parameter completion,

% zsh -f
% autoload -U compinit
% compinit
% compconf completer=_approximate 
% echo $ZSH_v[TAB]zsh: 15442 segmentation fault (core dumped)  zsh -f

but, don't generetes it after complete file name once.

% zsh -f
% autoload -U compinit
% compinit
% compconf completer=_approximate 
% ls
GNUstep      ZSH_VERSION  core         lab          tmp
Mail         bin          dic          lib          typescript
% ls ZSH_v[TAB]
% ls ZSH_VERSION 
ZSH_VERSION
% echo $ZSH_v[TAB]
% echo $ZSH_NAME 
correct to:
ZSH_NAME      ZSH_VERSION   


OS: Linux 2.0.36 (Debian GNU/Linux 2.1 slink)

---
Naoki Wakamatsu
naoki-w@ht-net21.ne.jp

Re: core dump on parameter completion

[Peter Stephenson]

Naoki Wakamatsu wrote:
> 3.1.6-test-2 generates core file on parameter completion,
> 
> % zsh -f
> % autoload -U compinit
> % compinit
> % compconf completer=_approximate 
> % echo $ZSH_v[TAB]zsh: 15442 segmentation fault (core dumped)  zsh -f

I get this too, on a different system (HPUX 10.20) --- here's a backtrace
with an unmodified 3.1.6-test-3 (which I'm about to upload). 

#0  0xc0082c80 in __strnlen ()
#1  0xc00fec34 in strncpy ()
#2  0xc191023c in inststrlen (
    str=0x40095ec8 <Address 0x40095ec8 out of bounds>, move=1, len=4)
    at zle_tricky.c:7219
#3  0xc191066c in cline_str (l=0x40034148, ins=0, csp=0x7aff28e0)
    at zle_tricky.c:7283
#4  0xc1911048 in unambig_data (cp=0x0) at zle_tricky.c:7435
#5  0xc15af82c in get_unambig (pm=0x4008aa30) at compctl.c:2324
#6  0x62fe0 in getstrvalue (v=0x7b03c3d0) at params.c:1266
#7  0x5f1f4 in scanparamvals (hn=0x4008aa30, flags=3) at params.c:381
#8  0x36320 in scanhashtable (ht=0x40024090, sorted=0, flags1=0, 
    flags2=131072, scanfunc=0x4000ca22 <default_watchfmt+2394>, scanflags=3)
    at hashtable.c:403
#9  0x5f3ec in paramvalarr (ht=0x40024090, flags=3) at params.c:403
#10 0x5f4d8 in getvaluearr (v=0x40053670) at params.c:421
#11 0x63324 in getarrvalue (v=0x40053670) at params.c:1310
#12 0x768d4 in $00000128 () at subst.c:1092
#13 0x729ec in stringsubst (list=0x40053640, node=0x40053660, ssub=0)
    at subst.c:122
#14 0x726e0 in prefork (list=0x40053640, flags=2) at subst.c:71
#15 0x23210 in addvars (l=0x40074fa8, export=0) at exec.c:1345
#16 0x23e2c in execcmd (cmd=0x40047e28, input=0, output=0, how=2, last1=2)
#17 0x222f4 in execpline2 (pline=0x40083ff0, how=2, input=0, output=0, last1=0)
    at exec.c:1054
#18 0x216a4 in execpline (l=0x4003cf08, how=2, last1=0) at exec.c:869
#19 0x210ac in execlist (list=0x40083fe0, dont_change_job=1, exiting=0)
    at exec.c:738
#20 0x287e4 in execautofn (cmd=0x4007c7c0, args=0x0, flags=0) at exec.c:2897
#21 0x256d8 in execcmd (cmd=0x4007c7c0, input=0, output=0, how=2, last1=2)
    at exec.c:1976
#22 0x222f4 in execpline2 (pline=0x40081490, how=2, input=0, output=0, last1=0)
    at exec.c:1054
#23 0x216a4 in execpline (l=0x4007dc68, how=2, last1=0) at exec.c:869
#24 0x210ac in execlist (list=0x400814a0, dont_change_job=1, exiting=0)
    at exec.c:738
#25 0x28d6c in runshfunc (list=0x8, wrap=0x2, name=0x0) at exec.c:3019
#26 0x55cb4 in dupstring (s=0x7070726f <Address 0x7070726f out of bounds>)
    at mem.c:494
#27 0x82874 in arrdup (s=0x400814a0) at utils.c:2234
#28 0xc15aff60 in comp_wrapper (list=0x400814a0, w=0x0, 
    name=0x4007de58 "_main_complete") at compctl.c:2415
#29 0x28cb0 in runshfunc (list=0x8, wrap=0xad4b5d35, name=0x0) at exec.c:3006
#30 0x55adc in zalloc (size=6) at mem.c:430
#31 0x55d24 in ztrdup (s=0x400814a0 "") at mem.c:507
#32 0x28a88 in doshfunc (name=0x4007de58 "_main_complete", list=0x400814a0, 
    doshargs=0x0, flags=0, noreturnval=0) at exec.c:2957
#33 0xc1903ed4 in callcompfunc (s=0x40034020 "ZSH_v", 
    fn=0x4007de58 "_main_complete") at zle_tricky.c:4778
#34 0xc1904af4 in makecomplist (s=0x40034020 "ZSH_v", incmd=0, lst=0)
    at zle_tricky.c:4935
#35 0xc1902180 in docompletion (s=0x4004d920 "\205ZSH_v", lst=0, incmd=0)
    at zle_tricky.c:4449
#36 0xc18f3fb4 in docomplete (lst=0) at zle_tricky.c:1076
#37 0xc18f1430 in expandorcomplete (args=0x7aff25d8) at zle_tricky.c:491
#38 0xc18f0dd8 in completecall (args=0x7aff25d8) at zle_tricky.c:390
#39 0xc18de98c in execzlefunc (func=0x7afecc90, args=0x7aff25d8)
    at zle_main.c:628
#40 0xc18de1dc in zleread (lp=0x40037f40 "%S[%m]%s %~ %# ", rp=0x0, flags=3)
    at zle_main.c:547
#41 0x42b10 in inputline () at input.c:265
#42 0x42998 in ingetc () at input.c:210
#43 0x396f8 in ihgetc () at hist.c:242
#44 0x4a0d8 in gettok () at lex.c:545
#45 0x49690 in yylex () at lex.c:308
#46 0x67fbc in parse_event () at parse.c:105
#47 0x3f5e0 in loop (toplevel=1, justonce=0) at init.c:113
#48 0xf9b8 in main (argc=2, argv=0x7b03aae4) at main.c:89

-- 
Peter Stephenson <pws@ibmth.df.unipi.it>       Tel: +39 050 844536
WWW:  http://www.ifh.de/~pws/
Dipartimento di Fisica, Via Buonarroti 2, 56127 Pisa, Italy

PATCH: 3.1.6-test-3: core dump on parameter completion

[Peter Stephenson]

Peter Stephenson wrote:
> Naoki Wakamatsu wrote:
> > 3.1.6-test-2 generates core file on parameter completion,
> > 
> > % zsh -f
> > % autoload -U compinit
> > % compinit
> > % compconf completer=_approximate 
> > % echo $ZSH_v[TAB]zsh: 15442 segmentation fault (core dumped)  zsh -f
> 
> I get this too, on a different system (HPUX 10.20)

Got it!  There's a missing dupstring(); the cline struct is an invalid
pointer (it's the positional parameter list from the function redefining
compadd, which will be freed before the line is inserted), even though the
returned completion r is correctly duplicated.  The only thing I can't
answer is whether r is really supposed to be different from w at this
point, but let's assume so until proved otherwise.

--- Src/Zle/zle_tricky.c.dups	Sun Jul 25 14:47:27 1999
+++ Src/Zle/zle_tricky.c	Tue Jul 27 16:43:30 1999
@@ -2617,6 +2617,7 @@
 	    chuck(r);
 	/* We still break it into parts here, trying to build a sensible
 	 * cline list for these matches, too. */
+	w = dupstring(w);
 	wl = strlen(w);
 	*clp = bld_parts(w, wl, wl, NULL);
 	*exact = 0;


-- 
Peter Stephenson <pws@ibmth.df.unipi.it>       Tel: +39 050 844536
WWW:  http://www.ifh.de/~pws/
Dipartimento di Fisica, Via Buonarroti 2, 56127 Pisa, Italy

Re: PATCH: 3.1.6-test-3: core dump on parameter completion

[Sven Wischnowsky]

Peter Stephenson wrote:

> Got it!  There's a missing dupstring(); the cline struct is an invalid
> pointer (it's the positional parameter list from the function redefining
> compadd, which will be freed before the line is inserted), even though the
> returned completion r is correctly duplicated.  The only thing I can't
> answer is whether r is really supposed to be different from w at this
> point, but let's assume so until proved otherwise.

Yes, that's correct. Other parts of the code may shorten the strings
in the cline lists (my last matching-code overhaul may have changed
the code so that the strings aren't really modified any more, but it's 
still safer).

Bye
 Sven


--
Sven Wischnowsky                         wischnow@informatik.hu-berlin.de