From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 25656 invoked by alias); 13 Aug 2013 10:53:37 -0000 Mailing-List: contact zsh-workers-help@zsh.org; run by ezmlm Precedence: bulk X-No-Archive: yes List-Id: Zsh Workers List List-Post: List-Help: X-Seq: 31653 Received: (qmail 3258 invoked from network); 13 Aug 2013 10:53:22 -0000 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on f.primenet.com.au X-Spam-Level: X-Spam-Status: No, score=-2.7 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FROM,RCVD_IN_DNSWL_LOW, T_TO_NO_BRKTS_FREEMAIL autolearn=ham version=3.3.2 Received-SPF: pass (ns1.primenet.com.au: SPF record at _netblocks.google.com designates 209.85.217.182 as permitted sender) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:date:message-id:subject:from:to:content-type; bh=43PlGeIf6RuohcJMoHD6In7Z//R576HP/2moC90g6xM=; b=vCR4iHEaUfPUZw8p2MtpRMyyywTJP2gvlownKtxWrd9mWhewRVLCPnrfqWepk7l4cd 59iiJwOclpWzVGHKdAWDooBgba6cNWiMzbxK+8RyNdq+w3fvbID3F6881UNJa6bUe3Uc DsLkBLVglVTRSS2GLiP+mTyGysnBcvq0Pfrk/ZyxRXP1dd0VLB3nHpgHp9n1N2hQn8Fx UAPzgUoeqYCk0Dk/VlI10P+w9FiPLyTgabqxYjmNe7D3PRMBx3dpwREm3b4AVEnh2zCc mikNZ2fUN9RGK5KHFw+ICMMdK5GJx5orwa3GhrkKyrRuvw2NcsxWo3QCyXtMdbPxQrp6 ylRQ== MIME-Version: 1.0 X-Received: by 10.152.19.97 with SMTP id d1mr1233658lae.34.1376391192924; Tue, 13 Aug 2013 03:53:12 -0700 (PDT) Date: Tue, 13 Aug 2013 20:53:12 +1000 Message-ID: Subject: segfault on 'echo $(< /dev/kmsg )' in zsh-5.0.2 and git From: Marien Zwart To: zsh-workers@zsh.org Content-Type: text/plain; charset=UTF-8 Hello zsh-workers, On zsh-5.0.2 as well as current git (40a881569fed17177fbd73079dd4d3849517567c), the following segfaults on my linux 3.10, glibc 2.17 system: echo $(< /dev/kmsg ) Tracing through it in gdb, I've found that's because the fdopen(in, "r") call in readoutput returned NULL (and then it predictably segfaults somewhere in the subsequent fgetc). Sticking a NULL check and zerr("fdopen: %e", errno); after the fdopen gets me "zsh: fdopen: invalid argument", and returning NULL after that at least doesn't make zsh immediately topple over. But I have no idea how safe that is (there's no other error return in readoutput), and it needs some tidying up such as closing the fd, so I'll leave properly patching this to someone else. That's assuming fdopen failing is considered possible. In this case, it happens because /dev/kmsg supports seek but not with whence SEEK_CUR, for which it fails with EINVAL (lseek(2) says "whence is not valid" is one condition resulting in EINVAL), and glibc accepts that seek failing with ESPIPE but not other reasons. Depending on which manpage you read fdopen() may fail if fcntl fails, which it may do for various reasons. So if it's not too hard it'd be nice for zsh to survive fdopen failing, although there's something to be said for fdopen (glibc) or the fd (linux kernel) being broken for this specific crash (on /dev/kmsg). -- Marien Zwart (marienz on freenode).