SIGSEGV caused by global substitution modifier

SIGSEGV caused by global substitution modifier

[Thorsten Meinecke]

Please have a look at this:

  $ zsh-2.6-beta5 -Fc 'FOO=123;echo $FOO:gs//bar/'
  bar
  $ zsh-2.6-beta10 -fc 'FOO=123;echo $FOO:gs//bar/'
  zsh: segmentation fault  zsh-2.6-beta10 -fc 'FOO=123;echo $FOO:gs//bar/'
  

$FOO:gs/// loops forever now, which is especially unpleasant (since
not interruptible) when it occurs in completion control functions like
P.Stephenson's new `multicomp'. This is how I noticed the problem.

You might want to try `!??:gs///' on the command line, too. Don't.

An empty left-hand side of a substitution has a special meaning
("use scan string or previous match"), right? Only if there's no
non-empty scan string or previous match, the left-hand side evaluates
to a null string, and zsh chokes.


There's another (somewhat related) problem: Used on the result of
parameter expansion, empty l strings of substitution modifiers don't
produce the expected result:

  $ FOO=1213
  $ echo $FOO:s/1/a/:s//b/
  b

I've expected `a2b3'. That is what `!:s/1/a/:s//b/' would give.

This "feature" is present at least since zsh-2.4.306-beta. Are there
any rationales behind this?


[zsh-2.6-beta10, Linux 1.2.0, libc 4.5.26, gcc 2.5.8]
-- 
Thorsten Meinecke
<kaefer@aglaia.snafu.de>

Re: SIGSEGV caused by global substitution modifier

[Zoltan Hidvegi]

Thorsten Meinecke wrote:
> 
> Please have a look at this:
> 
>   $ zsh-2.6-beta5 -Fc 'FOO=123;echo $FOO:gs//bar/'
>   bar
>   $ zsh-2.6-beta10 -fc 'FOO=123;echo $FOO:gs//bar/'
>   zsh: segmentation fault  zsh-2.6-beta10 -fc 'FOO=123;echo $FOO:gs//bar/'
>   
> 
> $FOO:gs/// loops forever now, which is especially unpleasant (since
> not interruptible) when it occurs in completion control functions like
> P.Stephenson's new `multicomp'. This is how I noticed the problem.
> 
> You might want to try `!??:gs///' on the command line, too. Don't.
> 
> An empty left-hand side of a substitution has a special meaning
> ("use scan string or previous match"), right? Only if there's no
> non-empty scan string or previous match, the left-hand side evaluates
> to a null string, and zsh chokes.
> 
> 
> There's another (somewhat related) problem: Used on the result of
> parameter expansion, empty l strings of substitution modifiers don't
> produce the expected result:
> 
>   $ FOO=1213
>   $ echo $FOO:s/1/a/:s//b/
>   b
> 
> I've expected `a2b3'. That is what `!:s/1/a/:s//b/' would give.

The patch below should fix all of your problems.

Bye,
  Zoltan

rcsdiff -qc -kk -r1.12 -r1.13 Src/subst.c
*** 1.12	1995/07/04 18:33:00
--- Src/subst.c	1995/07/07 00:29:43
***************
*** 1460,1466 ****
  	    case 's':
  		c = **ptr;
  		(*ptr)++;
- 		zsfree(hsubl);
  		zsfree(hsubr);
  		ptr1 = *ptr;
  		del = *ptr1++;
--- 1460,1465 ----
***************
*** 1473,1481 ****
  		for (ptr3 = ptr2; *ptr3 != del && *ptr3; ptr3++);
  		if ((sav = *ptr3))
  		    *ptr3++ = '\0';
! 		for (tt = hsubl = ztrdup(ptr1); *tt; tt++)
! 		    if (INULL(*tt))
! 			chuck(tt);
  		for (tt = hsubr = ztrdup(ptr2); *tt; tt++)
  		    if (INULL(*tt))
  			chuck(tt);
--- 1472,1485 ----
  		for (ptr3 = ptr2; *ptr3 != del && *ptr3; ptr3++);
  		if ((sav = *ptr3))
  		    *ptr3++ = '\0';
! 		if (*ptr1) {
! 		    zsfree(hsubl);
! 		    hsubl = ztrdup(ptr1);
! 		}
! 		if (hsubl)
! 		    for (tt = hsubl; *tt; tt++)
! 			if (INULL(*tt))
! 			    chuck(tt);
  		for (tt = hsubr = ztrdup(ptr2); *tt; tt++)
  		    if (INULL(*tt))
  			chuck(tt);
rcsdiff -qc -kk -r1.3 -r1.4 Src/hist.c
*** 1.3	1995/07/06 12:25:26
--- Src/hist.c	1995/07/07 00:29:43
***************
*** 881,887 ****
      int off, inlen, outlen;
  
      if (!*in)
! 	in = str;
      if (!(substcut = (char *)strstr(str, in)))
  	return;
      inlen = strlen(in);
--- 881,887 ----
      int off, inlen, outlen;
  
      if (!*in)
! 	in = str, gbal = 0;
      if (!(substcut = (char *)strstr(str, in)))
  	return;
      inlen = strlen(in);