From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <zsh-workers-return-33932-mason-zsh=primenet.com.au@zsh.org>
Received: (qmail 24018 invoked by alias); 8 Dec 2014 13:43:35 -0000
Mailing-List: contact zsh-workers-help@zsh.org; run by ezmlm
Precedence: bulk
X-No-Archive: yes
List-Id: Zsh Workers List <zsh-workers.zsh.org>
List-Post: <mailto:zsh-workers@zsh.org>
List-Help: <mailto:zsh-workers-help@zsh.org>
X-Seq: 33932
Received: (qmail 11765 invoked from network); 8 Dec 2014 13:43:33 -0000
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on f.primenet.com.au
X-Spam-Level: 
X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,RCVD_IN_DNSWL_NONE
	autolearn=ham version=3.3.2
X-Biglobe-Sender: <takimoto-j@kba.biglobe.ne.jp>
Content-Type: text/plain; charset=utf-8
Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.6\))
Subject: Re: free() error on simple input scripts
From: "Jun T." <takimoto-j@kba.biglobe.ne.jp>
In-Reply-To: <141206150753.ZM2978@torch.brasslantern.com>
Date: Mon, 8 Dec 2014 21:51:59 +0900
Content-Transfer-Encoding: quoted-printable
Message-Id: <9CCB71BC-6744-4FF8-BBBC-EE538DF02732@kba.biglobe.ne.jp>
References: <20141206042732.GA28745@ti.fritz.box> <141206150753.ZM2978@torch.brasslantern.com>
To: zsh-workers@zsh.org
X-Mailer: Apple Mail (2.1878.6)
X-Biglobe-Spnum: 57213

After the commit
48cd1b6c3b51a7bc6d45d4aeb7ff8c55d97a6f2a
    33894: boundary conditions in unmeta(), unmetafy()

test D07multibyte fails on my Mac as follows:

./D07multibyte.ztst: starting.
Testing multibyte with locale en_US.UTF-8
Test ./D07multibyte.ztst failed: bad status 134, expected 0 from:
  mkdir =E6=A2=B6=E6=B5=A6=E7=94=B1=E8=A8=98 '=D0=9F=D1=91=D1=82=D1=80 =
=D0=98=D0=BB=D1=8C=D0=B8=D1=87 =D0=A7=D0=B0=D0=B9=D0=BA=D0=BE=D0=B2=D1=81=D0=
=BA=D0=B8=D0=B9'
  (cd =E6=A2=B6=E6=B5=A6=E7=94=B1=E8=A8=98; print ${${(%):-%~}:t})
  (cd '=D0=9F=D1=91=D1=82=D1=80 =D0=98=D0=BB=D1=8C=D0=B8=D1=87 =
=D0=A7=D0=B0=D0=B9=D0=BA=D0=BE=D0=B2=D1=81=D0=BA=D0=B8=D0=B9'; print =
${${(%):-%~}:t})
Error output:
zsh(74285,0x7fff72bb3310) malloc: *** error for object 0x7f8162504998: =
incorrect checksum for freed object - object was probably modified after =
being freed.
*** set a breakpoint in malloc_error_break to debug
Was testing: Metafied characters in prompt expansion
./D07multibyte.ztst: test failed.

It seems the problem is in the following hunk:

> @@ -4208,8 +4208,10 @@ unmeta(const char *file_name)
>=20
>     meta =3D 0;
>     for (t =3D file_name; *t; t++) {
> -	if (*t =3D=3D Meta)
> -	    meta =3D 1;
> +	if (*t =3D=3D Meta) {
> +	    meta =3D t[1];
> +	    break;
> +	}
>     }

Breaking out of the for-loop leaves the pointer t at the first Meta
in file_name, and the value of newsz becomes too small.

How about the following?

diff --git a/Src/utils.c b/Src/utils.c
index 5c90638..ab3d3da 100644
--- a/Src/utils.c
+++ b/Src/utils.c
@@ -4208,10 +4208,8 @@ unmeta(const char *file_name)
    =20
     meta =3D 0;
     for (t =3D file_name; *t; t++) {
-	if (*t =3D=3D Meta) {
-	    meta =3D t[1];
-	    break;
-	}
+	if (*t =3D=3D Meta)
+	    meta =3D 1;
     }
     if (!meta) {
 	/*
@@ -4250,7 +4248,7 @@ unmeta(const char *file_name)
     }
=20
     for (t =3D file_name, p =3D fn; *t; p++)
-	if ((*p =3D *t++) =3D=3D Meta)
+	if ((*p =3D *t++) =3D=3D Meta && *t)
 	    *p =3D *t++ ^ 32;
     *p =3D '\0';
     return fn;