crashes when setting COLUMNS=0 or 1

[Mikael Magnusson <mikachu@gmail.com>]

To reproduce, run COLUMNS=0 and type two characters. This code in
zle_refresh is where it crashes, it looks quite suspicious too.

ZR_memset(p1 + nllen, zr_sp, winw - nllen);
p1[winw] = zr_zr;
if (nllen < winw)
    p1[winw + 1] = zr_zr;
else
    p1[winw + 1] = nl[winw + 1];

The code seems to expect nllen to possibly be larger than winw, yet it
passes winw - nllen to memset as the length? (which is where it
crashes). I can actually get a crash with a 1-char wide window too, by
just resizing the terminal and typing some characters (This doesn't
happen right away, needs to fiddle around for a bit, possibly ctrl-a
and type some more). At first I thought it had to be doublewidth
characters, but regular ones trigger it too. Hm, but this crashes
somewhere else:

(gdb) bt
#0  0x00007ffff74198d9 in free () from /lib64/libc.so.6
#1  0x000000000047d630 in free_colour_buffer () at prompt.c:1863
#2  0x00007ffff6aab222 in zle_free_highlight () at zle_refresh.c:374
#3  0x00007ffff6aaeb08 in zrefresh () at zle_refresh.c:1715
#4  0x00007ffff6aa1d1e in zlecore () at zle_main.c:1100
#5  0x00007ffff6aa22b5 in zleread (lp=0x6c3a98, rp=0x0, flags=3, context=0)
    at zle_main.c:1219
#6  0x00007ffff6aa45b5 in zle_main_entry (cmd=1, ap=0x7fffffffd290) at
zle_main.c:1874
#7  0x00000000004456dd in zleentry (cmd=1) at init.c:1363
#8  0x000000000044616f in inputline () at input.c:281
#9  0x0000000000445fe6 in ingetc () at input.c:217
#10 0x000000000043b8b6 in ihgetc () at hist.c:279
#11 0x000000000044e156 in gettok () at lex.c:717
#12 0x000000000044d907 in zshlex () at lex.c:395
#13 0x000000000046aefb in parse_event () at parse.c:451
#14 0x0000000000442a9d in loop (toplevel=1, justonce=0) at init.c:132
#15 0x0000000000445be6 in zsh_main (argc=2, argv=0x7fffffffd678) at init.c:1528
#16 0x0000000000410784 in main (argc=2, argv=0x7fffffffd678) at ./main.c:93

Not sure what's going on in this case.

-- 
Mikael Magnusson