From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <zsh-workers-return-41436-mason-zsh=primenet.com.au@zsh.org>
Received: (qmail 22439 invoked by alias); 18 Jul 2017 05:36:51 -0000
Mailing-List: contact zsh-workers-help@zsh.org; run by ezmlm
Precedence: bulk
X-No-Archive: yes
List-Id: Zsh Workers List <zsh-workers.zsh.org>
List-Post: <mailto:zsh-workers@zsh.org>
List-Help: <mailto:zsh-workers-help@zsh.org>
X-Seq: 41436
Received: (qmail 10493 invoked from network); 18 Jul 2017 05:36:51 -0000
X-Qmail-Scanner-Diagnostics: from mail-io0-f169.google.com by f.primenet.com.au (envelope-from <dana@dana.is>, uid 7791) with qmail-scanner-2.11 
 (clamdscan: 0.99.2/21882. spamassassin: 3.4.1.  
 Clear:RC:0(209.85.223.169):SA:0(-2.8/5.0):. 
 Processed in 1.486526 secs); 18 Jul 2017 05:36:51 -0000
X-Spam-Checker-Version: SpamAssassin 3.4.1 (2015-04-28) on f.primenet.com.au
X-Spam-Level: 
X-Spam-Status: No, score=-2.8 required=5.0 tests=HTML_MESSAGE,
	RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H2,SPF_PASS,T_DKIM_INVALID
	autolearn=unavailable autolearn_force=no version=3.4.1
X-Envelope-From: dana@dana.is
X-Qmail-Scanner-Mime-Attachments: |
X-Qmail-Scanner-Zip-Files: |
Received-SPF: pass (ns1.primenet.com.au: SPF record at _netblocks.google.com designates 209.85.223.169 as permitted sender)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=dana-is.20150623.gappssmtp.com; s=20150623;
        h=mime-version:from:date:message-id:subject:to;
        bh=Jy0sALq3l0CaEfrjba1adS6V4dvzbmGCBAkmeUQU7oc=;
        b=me6ljkWXYQWwRjqF8KBG6p9GCzsCHwX5/GawbESQJs+nbr2OH096X7vGWlkOJK+kPZ
         YY9eeE0doBC18Bv0P7h1HU30jZoHsngncIFjOWrOqR1nGEWUeMfRSuyGZCXUO3lYarsM
         he4G649G2fchQzZKDpSX5zRBxlmyA94wWOophbvY7wNJEG6vMogbYpt+S5wmebBmhifh
         qqF55RlOfQh5IIZJDdIAb2VJVBReZ9zNQxAMn0Tqa/JVGUheIWBhhkGFsrMDu6/JzMGV
         Xd7gyp40xB6f0t3f6WZtSwHMkCF6T3J85ZedrctsbaStIFMPtDhgKYG1EPrGRuqftP9Q
         TGmw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20161025;
        h=x-gm-message-state:mime-version:from:date:message-id:subject:to;
        bh=Jy0sALq3l0CaEfrjba1adS6V4dvzbmGCBAkmeUQU7oc=;
        b=tsRzWuqgjViq/auyaNTmMSdbjdh/YAlssFPskKHyM4rfb0pfi3Ho9iTYjQasGWOzrk
         jGT+Q9rkZmwF0UD4tTbIUuxhU1QXU44qWPRIO/PyZFx4+c/fKSnpY9jJf2mDZnZ7MknM
         FTwphdwrGY4aqsnidROIWuVzfzb8mnTEdC3SSwLDbOxxA0y/TyGzqqGDEq7B1xrPMFLs
         VG+ZXikICGQ/hr9/sEwL1zIlzYq6brGrkdipoKXonsNKIowWZ0MzOMUM5qwKycI/qEH6
         Wtwwf6VUfxjPm/e9dygjwjEiLiQzJN4uunXyye0KZaGySOgc8RzopI++9qJVAk/VCYyw
         38/g==
X-Gm-Message-State: AIVw110aREImRBiXMEJvmYwlNlIlwurk2VRMq0mReaOUEBq1SB8mnFVC
	h5FWAY5IIUO5zuSF+k7EMnSIO8nUMXAbzoM5aA==
X-Received: by 10.107.163.69 with SMTP id m66mr836553ioe.227.1500356201817;
 Mon, 17 Jul 2017 22:36:41 -0700 (PDT)
MIME-Version: 1.0
X-Originating-IP: [173.20.63.226]
From: dana <dana@dana.is>
Date: Tue, 18 Jul 2017 00:36:01 -0500
Message-ID: <CA+_8RBD6BzT5WTuNy7r=Lz9pR9i+8DVKHKJAfjcgOb18YT_kkA@mail.gmail.com>
Subject: Double-free crash in call to _values
To: zsh-workers@zsh.org
Content-Type: multipart/alternative; boundary="001a1140f6fa726a98055490e63c"

--001a1140f6fa726a98055490e63c
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hello,

This completion function =E2=80=94

#compdef foo
_values -S ':' 'val' 'val:val'

=E2=80=94 crashes zsh when i enter the following at the command line:

% foo abcd:val:<tab>

On *zsh 5.3.1 (x86_64-apple-darwin16.6.0)* from Homebrew i get an error
like this (sometimes it complains about not finding some gibberish command
first):

-zsh(83431,0x7fffc0b9b3c0) malloc: *** error for object 0x7fce5fa19970:
pointer being freed was not allocated
*** set a breakpoint in malloc_error_break to debug

I was also able to replicate on *zsh 5.1.1 (x86_64-ubuntu-linux-gnu)* from
Ubuntu 16.04, though the error it produces is less consistent. Here's one
example:

*** Error in `-zsh': munmap_chunk(): invalid pointer: 0x00000000015748f0 **=
*
=3D=3D=3D=3D=3D=3D=3D Backtrace: =3D=3D=3D=3D=3D=3D=3D=3D=3D
/lib/x86_64-linux-gnu/libc.so.6(+0x777e5)[0x7f21d02787e5]
/lib/x86_64-linux-gnu/libc.so.6(cfree+0x1a8)[0x7f21d0284ae8]
-zsh(freearray+0x21)[0x489ba1]
/usr/lib/x86_64-linux-gnu/zsh/5.1.1/zsh/complete.so(+0xa980)[0x7f21cf355980=
]
-zsh(runshfunc+0x91)[0x42e981]
-zsh(doshfunc+0x745)[0x42f335]
...

(Obviously when i encountered this 'in the wild' it was in a more useful
context, but i've tried to reduce the test case to the bare minimum.)

Please let me know if i can provide any other information. Cheers

dana

--001a1140f6fa726a98055490e63c--