core dumps with (( #\... ))

core dumps with (( #\... ))

[Adam Spiers]

Found this through mistyping #\a syntax :-)

% print $(( \#a ))
zsh: bad math expression: operand expected at `\#a '
zsh: 16508 segmentation fault (core dumped)  /bin/zsh

Here's another, maybe the same bug?

% (( 1 == #\M-/ )) && print yep
zsh: bad math expression: operand expected at `/ '
zsh: 17042 segmentation fault (core dumped)  /bin/zsh

Re: core dumps with (( #\... ))

[Peter Stephenson]

Adam Spiers wrote:
> Found this through mistyping #\a syntax :-)
> 
> % print $(( \#a ))
> zsh: bad math expression: operand expected at `\#a '
> zsh: 16508 segmentation fault (core dumped)  /bin/zsh

This time, it was simple innumeracy.  I fixed some irrelevant details while
I was looking at it (ptr hid a file static, and the error code wants the
unmetafied length of the string to be shown).

> Here's another, maybe the same bug?
> 
> % (( 1 == #\M-/ )) && print yep
> zsh: bad math expression: operand expected at `/ '
> zsh: 17042 segmentation fault (core dumped)  /bin/zsh

Yes, except that the supposed syntax, which is #\ followed by some key
string such as \M-/, doesn't work because the \\ is turned into a single \
by double quoting rules, so actually you need #\\\M-/, which is rather
unfortunate.  Maybe the syntax should have been ## for a key string, then
both the errors which led to uncovering the bug would be less likely.
Should I change it but keep \ for backward compatibility?

--- Src/math.c.agen	Thu Sep 23 09:55:50 1999
+++ Src/math.c	Thu Sep 23 13:56:53 1999
@@ -947,7 +947,7 @@
 
 /**/
 static void
-checkunary(int mtokc, char *ptr)
+checkunary(int mtokc, char *mptr)
 {
     int errmsg = 0;
     int tp = type[mtokc];
@@ -959,11 +959,11 @@
 	    errmsg = 2;
     }
     if (errmsg) {
-	char errbuf[40];
+	char errbuf[80];
 	int len, over = 0;
-	while (inblank(*ptr))
-	    ptr++;
-	len = strlen(ptr);
+	while (inblank(*mptr))
+	    mptr++;
+	len = ztrlen(mptr);
 	if (len > 10) {
 	    len = 10;
 	    over = 1;
@@ -971,7 +971,7 @@
 	sprintf(errbuf, "bad math expression: %s expected at `%%l%s'",
 		errmsg == 2 ? "operator" : "operand",
 		over ? "..." : ""); 
-	zerr(errbuf, ptr, len);
+	zerr(errbuf, mptr, len);
     }
     unary = !(tp & OP_OPF);
 }

-- 
Peter Stephenson <pws@ibmth.df.unipi.it>       Tel: +39 050 844536
WWW:  http://www.ifh.de/~pws/
Dipartimento di Fisica, Via Buonarroti 2, 56127 Pisa, Italy

Re: core dumps with (( #\... ))

[Peter Stephenson]

Sven Wischnowsky wrote:
> > Should I change it but keep \ for backward compatibility?
> 
> That would be kind.

This is not hard.

--- Doc/Zsh/arith.yo.mchar	Tue Sep 21 11:25:32 1999
+++ Doc/Zsh/arith.yo	Thu Sep 23 15:43:36 1999
@@ -86,13 +86,14 @@
 arithmetic expressions. The shell currently defines no mathematical
 functions, but modules may define some.
 
-An expression of the form `tt(#\)var(x)' where var(x) is any character
+An expression of the form `tt(##)var(x)' where var(x) is any character
 sequence such as `tt(a)', `tt(^A)', or `tt(\M-\C-x)' gives the ascii
 value of this character and an expression of the form `tt(#)var(foo)'
 gives the ascii value of the first character of the value of the
 parameter var(foo).  Note that this is different from the expression
 `tt($#)var(foo)', a standard parameter substitution which gives the
-length of the parameter var(foo).
+length of the parameter var(foo).  `tt(#\)' is accepted instead of
+`tt(##)', but its use is deprecated.
 
 Named parameters and subscripted arrays can be referenced by name within an
 arithmetic expression without using the parameter expansion syntax.  For
--- Src/math.c.mchar	Thu Sep 23 15:42:18 1999
+++ Src/math.c	Thu Sep 23 15:42:20 1999
@@ -374,7 +374,7 @@
 		return NUM;
 	    }
 	    if (*ptr == '#') {
-		if (*++ptr == '\\') {
+		if (*++ptr == '\\' || *ptr == '#') {
 		    int v;
 
 		    ptr++;

-- 
Peter Stephenson <pws@ibmth.df.unipi.it>       Tel: +39 050 844536
WWW:  http://www.ifh.de/~pws/
Dipartimento di Fisica, Via Buonarroti 2, 56127 Pisa, Italy

Re: core dumps with (( #\... ))

[Sven Wischnowsky]

Peter Stephenson wrote:

> Yes, except that the supposed syntax, which is #\ followed by some key
> string such as \M-/, doesn't work because the \\ is turned into a single \
> by double quoting rules, so actually you need #\\\M-/, which is rather
> unfortunate.  Maybe the syntax should have been ## for a key string, then
> both the errors which led to uncovering the bug would be less likely.

Oh, stupid me... good idea.

> Should I change it but keep \ for backward compatibility?

That would be kind.

Bye
 Sven


--
Sven Wischnowsky                         wischnow@informatik.hu-berlin.de