From: Jun T <takimoto-j@kba.biglobe.ne.jp>
To: zsh-workers@zsh.org
Cc: Connor Olding <cloningdonor@gmail.com>
Subject: Re: Crash with read-only CDPATH
Date: Tue, 2 Jul 2024 19:27:22 +0900 [thread overview]
Message-ID: <A4710344-95A0-48DC-BD1E-A4CCD1B08251@kba.biglobe.ne.jp> (raw)
In-Reply-To: <CAD9VzoAct1RxG-TMYR2vxau+pTDt_5ZVQXjPgL3Wy5RaZueKcw@mail.gmail.com>
> 2024/06/30 9:11, Connor Olding <cloningdonor@gmail.com> wrote:
>
> This minimal example immediately crashes zsh:
>
> readonly CDPATH; CDPATH= cd
Thank you for the report.
If CDPATH (a special parameter) is made readonly, save_params()
(called at exec.c:4071) does not allocate any memory for tpm,
but the original pm (obtained by paramtab->getnode() at line 4410)
is added to the restorelist (line 4442).
After addvars() (line 4083) fails ("read-only variable" error),
restore_params() (line 4086) tries to restore CDPATH,
but in this function
pm (from the restorelist, line 4471), and
tpm (from paramtab, line 4473)
point to the same memory (the original CDPATH).
Then
exec.c:4483 tpm->gsu.s->setfn(tpm, pm->u.str)
coredumps when trying to free the memory for pm->u.str.
pm->u.str is the same data as pm->u.data,
and in the case of the original CDPATH it points to the global
variable 'char **cdpath' (line 61) and can't be freed.
I _guess_, in save_param(), we need to add tpm to restorelist
only if a copy of pm (i.e., tpm) is allocated.
Is this reasonable?
diff --git a/Src/exec.c b/Src/exec.c
index e955e85df..ac6c82ec6 100644
--- a/Src/exec.c
+++ b/Src/exec.c
@@ -4408,7 +4408,7 @@ save_params(Estate state, Wordcode pc, LinkList *restore_p, LinkList *remove_p)
while (wc_code(ac = *pc) == WC_ASSIGN) {
s = ecrawstr(state->prog, pc + 1, NULL);
if ((pm = (Param) paramtab->getnode(paramtab, s))) {
- Param tpm;
+ Param tpm = NULL;
if (pm->env)
delenv(pm);
if (!(pm->node.flags & PM_SPECIAL)) {
@@ -4425,7 +4425,6 @@ save_params(Estate state, Wordcode pc, LinkList *restore_p, LinkList *remove_p)
tpm = (Param) zshcalloc(sizeof *tpm);
tpm->node.nam = ztrdup(pm->node.nam);
copyparam(tpm, pm, 0);
- pm = tpm;
} else if (!(pm->node.flags & PM_READONLY) &&
(unset(RESTRICTED) || !(pm->node.flags & PM_RESTRICTED))) {
/*
@@ -4436,10 +4435,10 @@ save_params(Estate state, Wordcode pc, LinkList *restore_p, LinkList *remove_p)
tpm = (Param) hcalloc(sizeof *tpm);
tpm->node.nam = pm->node.nam;
copyparam(tpm, pm, 1);
- pm = tpm;
}
addlinknode(*remove_p, dupstring(s));
- addlinknode(*restore_p, pm);
+ if (tpm)
+ addlinknode(*restore_p, tpm);
} else
addlinknode(*remove_p, dupstring(s));
next prev parent reply other threads:[~2024-07-02 10:28 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-06-30 0:11 Connor Olding
2024-07-02 10:27 ` Jun T [this message]
2024-07-02 18:04 ` Bart Schaefer
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=A4710344-95A0-48DC-BD1E-A4CCD1B08251@kba.biglobe.ne.jp \
--to=takimoto-j@kba.biglobe.ne.jp \
--cc=cloningdonor@gmail.com \
--cc=zsh-workers@zsh.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.vuxu.org/mirror/zsh/
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).