Double-free crash in call to _values

Double-free crash in call to _values

[dana]

[-- Attachment #1: Type: text/plain, Size: 1303 bytes --]

Hello,

This completion function —

#compdef foo
_values -S ':' 'val' 'val:val'

— crashes zsh when i enter the following at the command line:

% foo abcd:val:<tab>

On *zsh 5.3.1 (x86_64-apple-darwin16.6.0)* from Homebrew i get an error
like this (sometimes it complains about not finding some gibberish command
first):

-zsh(83431,0x7fffc0b9b3c0) malloc: *** error for object 0x7fce5fa19970:
pointer being freed was not allocated
*** set a breakpoint in malloc_error_break to debug

I was also able to replicate on *zsh 5.1.1 (x86_64-ubuntu-linux-gnu)* from
Ubuntu 16.04, though the error it produces is less consistent. Here's one
example:

*** Error in `-zsh': munmap_chunk(): invalid pointer: 0x00000000015748f0 ***
======= Backtrace: =========
/lib/x86_64-linux-gnu/libc.so.6(+0x777e5)[0x7f21d02787e5]
/lib/x86_64-linux-gnu/libc.so.6(cfree+0x1a8)[0x7f21d0284ae8]
-zsh(freearray+0x21)[0x489ba1]
/usr/lib/x86_64-linux-gnu/zsh/5.1.1/zsh/complete.so(+0xa980)[0x7f21cf355980]
-zsh(runshfunc+0x91)[0x42e981]
-zsh(doshfunc+0x745)[0x42f335]
...

(Obviously when i encountered this 'in the wild' it was in a more useful
context, but i've tried to reduce the test case to the bare minimum.)

Please let me know if i can provide any other information. Cheers

dana

Re: Double-free crash in call to _values

[Bart Schaefer]

On Mon, Jul 17, 2017 at 10:36 PM, dana <dana@dana.is> wrote:
>
> #compdef foo
> _values -S ':' 'val' 'val:val'
>
> — crashes zsh

Fixed by workers/40362 back in January.

Re: Double-free crash in call to _values

[dana]

[-- Attachment #1: Type: text/plain, Size: 313 bytes --]

Oops, i missed that. Thank you!


On 18 July 2017 at 00:45, Bart Schaefer <schaefer@brasslantern.com> wrote:

> On Mon, Jul 17, 2017 at 10:36 PM, dana <dana@dana.is> wrote:
> >
> > #compdef foo
> > _values -S ':' 'val' 'val:val'
> >
> > — crashes zsh
>
> Fixed by workers/40362 back in January.
>