Re: Core dump in 3.0.3-test5

[Zoltan Hidvegi <hzoli@xxxxxxxxxxxxxxxxxxx>]

> zagzig<1> mv zsh-3.0.3-test5 !#:^-tmp
> zsh: no such event: 1
> zagzig<2> mv zsh-3.0.3-test5 !#:^-tmp
> mv zsh-3.0.3-test5 zsh-3.0.3-test5 tmp
> zsh: segmentation fault (core dumped)  ./zsh

Fix is below.  You may not like this fix:

% echo foo !:^-bar
zsh: no such word in event

Some explanation.  When !:^-bar is expanded, there is still only `echo foo'
stored in the history. ^- selects everything from the first argument except
the last one, which means 1-0 range in this case, which is invalid.  And
the new behaviour is tcsh compatible.  Before this patch zsh corrupted
memory on all !:a-b substitution when `b' was less than `a'.  The real fix
is the first hunk, the second hunk is just a cosmetic optimisation change.

Zoltan


*** Src/hist.c	1997/05/11 06:42:21	3.1.2.4
--- Src/hist.c	1997/05/12 07:48:55
***************
*** 1153,1163 ****
  char *
  getargs(Histent elist, int arg1, int arg2)
  {
-     char *ret;
      short *words = elist->words;
      int pos1, nwords = elist->nwords;
  
!     if (arg1 >= nwords || arg2 >= nwords) {
  	/* remember, argN is indexed from 0, nwords is total no. of words */
  	inerrflush();
  	zerr("no such word in event", NULL, 0);
--- 1153,1162 ----
  char *
  getargs(Histent elist, int arg1, int arg2)
  {
      short *words = elist->words;
      int pos1, nwords = elist->nwords;
  
!     if (arg2 < arg1 || arg1 >= nwords || arg2 >= nwords) {
  	/* remember, argN is indexed from 0, nwords is total no. of words */
  	inerrflush();
  	zerr("no such word in event", NULL, 0);
***************
*** 1165,1174 ****
      }
  
      pos1 = words[2*arg1];
!     ret = dupstring(elist->text + pos1);
!     ret[words[2*arg2+1] - pos1] = '\0';
!     
!     return ret;
  }
  
  /**/
--- 1164,1170 ----
      }
  
      pos1 = words[2*arg1];
!     return dupstrpfx(elist->text + pos1, words[2*arg2+1] - pos1);
  }
  
  /**/