compctl bug with beta17 on Linux

[Hrvoje Niksic <hniksic@xxxxxxxxxxxxxxxxx>]

Hi!

I've found a serious bug that causes zsh-2.6beta17 (but also beta14 and
probably lots of others) to dump core on Linux box with uname -a output:
Linux gnjilux.cc.fer.hr 1.3.98 #1 Wed May 8 03:52:40 MET DST 1996 i486


In some cases zsh coredumps when programmable completion is set, like in:
compctl -g '*(D-/)' cd

and
cd /home/p[TAB]

where the file/dir beginning with 'p' doesn't exist, it coredumps. It fails
always on this one, but in other cases it doesn't (like cd /tmp/x[TAB] when
there's no 'x' in /tmp). The problem repeats in some other cases, like in
cd /proc/<something>[TAB], which should mean that the problem is not at
Linux's side. The problem disappears if cd is not compctl-ed.

gdb shows that the shell fails in zle_tricky.c, in the second call of
get_ccompctl, where the cmdstr contains garbage (instead of "cd"), and
causes declaration char *cmd = dupstring(cmdstr) to coredump in strcpy.

Further analysis shows that cmdstr (or at least the contents of the memory
it points to) gets garbled when newlinklist() is called in zle_tricky, line
2174,
fmatches = newlinklist()

The contents cmdstr points to is garbled in alloc, which might show the bug
in allocation routines.

Zsh allocation routines were not used.