Re: crash/memory corruption when completing dynamic named directory

[Mikael Magnusson <mikachu@gmail.com>]

On 27 March 2011 13:32, Mikael Magnusson <mikachu@gmail.com> wrote:
> 2011/3/26 Benjamin R. Haskell <zsh@benizi.com>:
>> On Sat, 26 Mar 2011, Johan Sundström wrote:
>>
>>> On Sat, Mar 26, 2011 at 05:54, Mikael Magnusson wrote:
>>>
>>>> I can't reproduce this in zsh -f yet, all that happens is that the
>>>> completion just fails quietly without doing anything.
>>>> % echo ネネネネネ ~[<tab>
>>>> results in
>>>> % echo <e3><ad><e3><ad><e3><ad><e3><ad><e3><ad> ~[
>>>>
>>>> any idea what could be wrong or what I can try to narrow it down?
>>
>> The problem is that the string of 'ne's is being unmetafy'ed when it
>> shouldn't be.  I don't know where.  But that's what's happening.
>
> calling stringaszleline with zlemetaline only occurs in one other
> place: unmetafy_line :).
>
> pws, afaict, only the first little bit of zlemetaline is needed for
> this, ie the outcs calculation. Would it be okay to split this out to
> a separate function and call that from get_cursor and stringaszleline?
> Otherwise we have to copy zlemetaline first and then run
> stringaszleline, and discard all that work, which seems silly. Or does
> outcs actually depend on the conversion too? There's a comment that
> suggests it doesn't, but there are some assignments to it further
> down.

Here's a patch for copying the string and doing all the work, which
I've confirmed fixes the issue.

diff --git a/Src/Zle/zle_params.c b/Src/Zle/zle_params.c
index 98091b2..2c35874 100644
--- a/Src/Zle/zle_params.c
+++ b/Src/Zle/zle_params.c
@@ -233,8 +233,10 @@ get_cursor(UNUSED(Param pm))
 	/* A lot of work for one number, but still... */
 	ZLE_STRING_T tmpline;
 	int tmpcs, tmpll, tmpsz;
-	tmpline = stringaszleline(zlemetaline, zlemetacs,
+	char *tmpmetaline = ztrdup(zlemetaline);
+	tmpline = stringaszleline(tmpmetaline, zlemetacs,
 				  &tmpll, &tmpsz, &tmpcs);
+	free(tmpmetaline);
 	free(tmpline);
 	return tmpcs;
     }


-- 
Mikael Magnusson