PATCH: 3.1.6-test-3: crash in _cvs dot-files stuff

[Peter Stephenson <pws@xxxxxxxxxxxxxxxxx>]

Tanaka Akira wrote:
> In article <9907281334.AA33903@xxxxxxxxxxxxxxxxx>,
>   Peter Stephenson <pws@xxxxxxxxxxxxxxxxx> writes:
> 
> > I can't get this any simple way, nor does the pattern itself seem to be the
> > problem.  Is there an easy way of showing it (e.g. with a fixed argument to
> > compgen?)
> 
> It is reproduced under my Solaris 7 environment.
>
> #0  0xff0b051c in makecomplistflags (cc=0x1278b0, s=0xce410 "", incmd=0, 
>     compadd=0) at zle_tricky.c:6380
> 6380                                    pa[o] = '\0';

This gives the game away.  The pattern was arbitrarily limited to PATH_MAX
--- but unlike the resulting file, there's no reason why it should be, nor
was it tested.  The following makes the buffer dynamically reallocated.  At
this time pre-release it's good to be sensitive to memory leaks, but I
don't see one.  Please don't take my word for it.

--- Src/Zle/zle_tricky.c.pm	Tue Jul 27 17:07:08 1999
+++ Src/Zle/zle_tricky.c	Wed Jul 28 17:49:06 1999
@@ -6283,8 +6283,8 @@
 			    gen_matches_files(1, 0, 0);
 			/* The compctl has a glob pattern (compctl -g). */
 			if (cc->glob) {
-			    int ns, pl = strlen(prpre), o;
-			    char *g = dupstring(cc->glob), pa[PATH_MAX];
+			    int ns, pl = strlen(prpre), o, paalloc;
+			    char *g = dupstring(cc->glob), *pa;
 			    char *p2, *p3;
 			    int ne = noerrs, md = opts[MARKDIRS];
 
@@ -6298,8 +6298,9 @@
 			    }
 			    noerrs = 1;
 			    addwhat = -6;
+			    o = strlen(prpre);
+			    pa = (char *)zalloc(paalloc = o + PATH_MAX);
 			    strcpy(pa, prpre);
-			    o = strlen(pa);
 			    opts[MARKDIRS] = 0;
 
 			    /* The compctl -g string may contain more than *
@@ -6338,6 +6339,10 @@
 				else {
 				/* It's a simple pattern, so append it to *
 				 * the path we have on the command line.  */
+				    int minlen = o + strlen(g);
+				    if (minlen > paalloc)
+					pa = (char *)
+					    zrealloc(pa, paalloc = minlen+1);
 				    strcpy(pa + o, g);
 				    addlinknode(l, dupstring(pa));
 				}
@@ -6383,6 +6388,8 @@
 			    glob_pre = glob_suf = NULL;
 			    noerrs = ne;
 			    opts[MARKDIRS] = md;
+
+			    zfree(pa, paalloc);
 			}
 		    }
 		    dirs++;

-- 
Peter Stephenson <pws@xxxxxxxxxxxxxxxxx>       Tel: +39 050 844536
WWW:  http://www.ifh.de/~pws/
Dipartimento di Fisica, Via Buonarroti 2, 56127 Pisa, Italy