Double free with latest updates

Double free with latest updates

[Vin Shelton]

[-- Attachment #1: Type: text/plain, Size: 1144 bytes --]

The most recent changes to builtin.c result in a double free in running the
test suite.

I have more details if you need them.

  - Vin

zsh
remote: Counting objects: 9, done.
remote: Compressing objects: 100% (5/5), done.
remote: Total 5 (delta 4), reused 0 (delta 0)
Unpacking objects: 100% (5/5), done.
>From git://zsh.git.sf.net/gitroot/zsh/zsh
   5b00bfe..1e6fb1a  master     -> origin/master
Updating 5b00bfe..1e6fb1a
Fast-forward
 ChangeLog     | 4 ++++
 Src/builtin.c | 7 ++++---
 2 files changed, 8 insertions(+), 3 deletions(-)

Building zsh
/opt/src/zsh-2015-05-04
cd . && ./.preconfig
Configuring zsh-2015-05-04 for installation prefix /opt/zsh-2015-05-04.
Building zsh...done.
Running tests...%
                print ten ten nine one print

  print print one two three four five six seven eight nine ten one two

  print mystery sequence

  print one

  print two

  print mystery sequence

  print metaphor\? shmetaphor!

  print metaphor!

  print -l metophor, Molochi,

  echo $(echo foo bar) again

  echo more $( echo $(echo foo bar) again )

done.

*** Error in `zsh': double free or corruption (out): 0x00007fff694af880 ***

Re: Double free with latest updates

[Mikael Magnusson]

On Mon, May 4, 2015 at 1:20 PM, Vin Shelton <acs@alumni.princeton.edu> wrote:
> The most recent changes to builtin.c result in a double free in running the
> test suite.
>
> I have more details if you need them.
>
>   - Vin
>
> zsh
> remote: Counting objects: 9, done.
> remote: Compressing objects: 100% (5/5), done.
> remote: Total 5 (delta 4), reused 0 (delta 0)
> Unpacking objects: 100% (5/5), done.
> From git://zsh.git.sf.net/gitroot/zsh/zsh
>    5b00bfe..1e6fb1a  master     -> origin/master
> Updating 5b00bfe..1e6fb1a
> Fast-forward
>  ChangeLog     | 4 ++++
>  Src/builtin.c | 7 ++++---
>  2 files changed, 8 insertions(+), 3 deletions(-)
>
> Building zsh
> /opt/src/zsh-2015-05-04
> cd . && ./.preconfig
> Configuring zsh-2015-05-04 for installation prefix /opt/zsh-2015-05-04.
> Building zsh...done.
> Running tests...%
> print ten ten nine one print
>   print print one two three four five six seven eight nine ten one two
>   print mystery sequence
>   print one
>   print two
>   print mystery sequence
>   print metaphor\? shmetaphor!
>   print metaphor!
>   print -l metophor, Molochi,
>   echo $(echo foo bar) again
>   echo more $( echo $(echo foo bar) again )
> done.
> *** Error in `zsh': double free or corruption (out): 0x00007fff694af880 ***
>

Doesn't happen here with or without --enable-zsh-{mem,debug}. Valgrind
also didn't complain at all. Enable the MALLOC_CHECK_ flag that
enables backtrace on double free and see if it says anything useful.

"If MALLOC_CHECK_ is set to 0, any detected heap corruption is
silently ignored; if set to 1, a diagnostic is printed on stderr; if
set to 2, abort is called immediately."

-- 
Mikael Magnusson

Re: Double free with latest updates

[Vin Shelton]

[-- Attachment #1: Type: text/plain, Size: 2255 bytes --]

Dear Mikael,

On Mon, May 4, 2015 at 10:38 AM, Mikael Magnusson <mikachu@gmail.com> wrote:

> On Mon, May 4, 2015 at 1:20 PM, Vin Shelton <acs@alumni.princeton.edu>
> wrote:
> > The most recent changes to builtin.c result in a double free in running
> the
> > test suite.
> >
> > I have more details if you need them.
> >
> >   - Vin
> >
> > zsh
> > remote: Counting objects: 9, done.
> > remote: Compressing objects: 100% (5/5), done.
> > remote: Total 5 (delta 4), reused 0 (delta 0)
> > Unpacking objects: 100% (5/5), done.
> > From git://zsh.git.sf.net/gitroot/zsh/zsh
> >    5b00bfe..1e6fb1a  master     -> origin/master
> > Updating 5b00bfe..1e6fb1a
> > Fast-forward
> >  ChangeLog     | 4 ++++
> >  Src/builtin.c | 7 ++++---
> >  2 files changed, 8 insertions(+), 3 deletions(-)
> >
> > Building zsh
> > /opt/src/zsh-2015-05-04
> > cd . && ./.preconfig
> > Configuring zsh-2015-05-04 for installation prefix /opt/zsh-2015-05-04.
> > Building zsh...done.
> > Running tests...%
> > print ten ten nine one print
> >   print print one two three four five six seven eight nine ten one two
> >   print mystery sequence
> >   print one
> >   print two
> >   print mystery sequence
> >   print metaphor\? shmetaphor!
> >   print metaphor!
> >   print -l metophor, Molochi,
> >   echo $(echo foo bar) again
> >   echo more $( echo $(echo foo bar) again )
> > done.
> > *** Error in `zsh': double free or corruption (out): 0x00007fff694af880
> ***
> >
>
> Doesn't happen here with or without --enable-zsh-{mem,debug}. Valgrind
> also didn't complain at all. Enable the MALLOC_CHECK_ flag that
> enables backtrace on double free and see if it says anything useful.
>
> "If MALLOC_CHECK_ is set to 0, any detected heap corruption is
> silently ignored; if set to 1, a diagnostic is printed on stderr; if
> set to 2, abort is called immediately."
>

Thanks for the suggestion, but I can no longer trigger a failure.  I tried
running

make check

from the command line.  I also tried running it from a

#!/usr/bin/env zsh

script (as my nightly build script does).  In each case, all tests passed
and no double free was recorded.

I will run with this shell and will let you know if I observe any failures.

Sorry for any troubles this may have caused.

  - Vin