Zsh Mailing List Archive Messages sorted by: Reverse Date, Date, Thread, Author

Re: Completion problem on right hand side of assignment.

X-seq: zsh-workers 6197
From: Sven Wischnowsky <wischnow@xxxxxxxxxxxxxxxxxxxxxxx>
To: zsh-workers@xxxxxxxxxxxxxx
Subject: Re: Completion problem on right hand side of assignment.
Date: Mon, 3 May 1999 11:18:45 +0200 (MET DST)
In-reply-to: Tanaka Akira's message of 03 May 1999 01:46:18 +0900
Mailing-list: contact zsh-workers-help@xxxxxxxxxxxxxx; run by ezmlm

Tanaka Akira wrote:

> ...
> rascal% A=Doc/Zsh/zsh: segmentation fault (core dumped)  ./Src/zsh -f
> Z:akr@rascal% 
> ...
>   BUG: attempt to free already free storage
>   BUG: attempt to free storage at invalid address

Seems like clwnum is off-by-one after parsing an assignment. This
caused compwords to be allocated one field too short in callcompfunc
and then the NULL pointer terminating it could be overwritten.

This should fix it.

Bye
 Sven

diff -u os/Zle/zle_tricky.c Src/Zle/zle_tricky.c
--- os/Zle/zle_tricky.c	Mon May  3 11:07:15 1999
+++ Src/Zle/zle_tricky.c	Mon May  3 11:07:50 1999
@@ -4360,7 +4360,7 @@
 
 	    PERMALLOC {
 		q = compwords = (char **)
-		    zalloc((clwnum - aadd + 1) * sizeof(char *));
+		    zalloc((clwnum + 1) * sizeof(char *));
 		for (p = clwords + aadd; *p; p++, q++) {
 		    tmp = dupstring(*p);
 		    untokenize(tmp);

--
Sven Wischnowsky                         wischnow@xxxxxxxxxxxxxxxxxxxxxxx

Messages sorted by: Reverse Date, Date, Thread, Author