Crash with read-only CDPATH

Crash with read-only CDPATH

[Connor Olding]

[-- Attachment #1: Type: text/plain, Size: 430 bytes --]

Hey. I don't really use mailing lists, but I have a bug to report. This
minimal example immediately crashes zsh:

readonly CDPATH; CDPATH= cd

zsh:1: read-only variable: CDPATH
free(): invalid pointer
Aborted (core dumped)

This version of zsh was installed from the Ubuntu 24.04 (x86_64) repos; the
package version is 5.9-6ubuntu2. I can confirm the issue is also present
(it hangs) on MSYS2, where the package version is 5.9-2.

[-- Attachment #2: Type: text/html, Size: 480 bytes --]

Re: Crash with read-only CDPATH

[Jun T]

> 2024/06/30 9:11, Connor Olding <cloningdonor@gmail.com> wrote:
> 
> This minimal example immediately crashes zsh:
> 
> readonly CDPATH; CDPATH= cd

Thank you for the report.

If CDPATH (a special parameter) is made readonly, save_params()
(called at exec.c:4071) does not allocate any memory for tpm,
but the original pm (obtained by paramtab->getnode() at line 4410)
is added to the restorelist (line 4442).

After addvars() (line 4083) fails ("read-only variable" error),
restore_params() (line 4086) tries to restore CDPATH,
but in this function
  pm (from the restorelist, line 4471), and
  tpm (from paramtab, line 4473)
point to the same memory (the original CDPATH).

Then
    exec.c:4483    tpm->gsu.s->setfn(tpm, pm->u.str)
coredumps when trying to free the memory for pm->u.str.

pm->u.str is the same data as pm->u.data,
and in the case of the original CDPATH it points to the global
variable 'char **cdpath' (line 61) and can't be freed.

I _guess_, in save_param(), we need to add tpm to restorelist
only if a copy of pm (i.e., tpm) is allocated.

Is this reasonable?


diff --git a/Src/exec.c b/Src/exec.c
index e955e85df..ac6c82ec6 100644
--- a/Src/exec.c
+++ b/Src/exec.c
@@ -4408,7 +4408,7 @@ save_params(Estate state, Wordcode pc, LinkList *restore_p, LinkList *remove_p)
     while (wc_code(ac = *pc) == WC_ASSIGN) {
 	s = ecrawstr(state->prog, pc + 1, NULL);
 	if ((pm = (Param) paramtab->getnode(paramtab, s))) {
-	    Param tpm;
+	    Param tpm = NULL;
 	    if (pm->env)
 		delenv(pm);
 	    if (!(pm->node.flags & PM_SPECIAL)) {
@@ -4425,7 +4425,6 @@ save_params(Estate state, Wordcode pc, LinkList *restore_p, LinkList *remove_p)
 		tpm = (Param) zshcalloc(sizeof *tpm);
 		tpm->node.nam = ztrdup(pm->node.nam);
 		copyparam(tpm, pm, 0);
-		pm = tpm;
 	    } else if (!(pm->node.flags & PM_READONLY) &&
 		       (unset(RESTRICTED) || !(pm->node.flags & PM_RESTRICTED))) {
 		/*
@@ -4436,10 +4435,10 @@ save_params(Estate state, Wordcode pc, LinkList *restore_p, LinkList *remove_p)
 		tpm = (Param) hcalloc(sizeof *tpm);
 		tpm->node.nam = pm->node.nam;
 		copyparam(tpm, pm, 1);
-		pm = tpm;
 	    }
 	    addlinknode(*remove_p, dupstring(s));
-	    addlinknode(*restore_p, pm);
+	    if (tpm)
+		addlinknode(*restore_p, tpm);
 	} else
 	    addlinknode(*remove_p, dupstring(s));
 

Re: Crash with read-only CDPATH

[Bart Schaefer]

On Tue, Jul 2, 2024 at 3:27 AM Jun T <takimoto-j@kba.biglobe.ne.jp> wrote:
>
> If CDPATH (a special parameter) is made readonly, save_params()
> (called at exec.c:4071) does not allocate any memory for tpm,
> but the original pm (obtained by paramtab->getnode() at line 4410)
> is added to the restorelist (line 4442).
>
> I _guess_, in save_param(), we need to add tpm to restorelist
> only if a copy of pm (i.e., tpm) is allocated.
>
> Is this reasonable?

It looks reasonable to me, yes.  Thanks for investigating.