PATCH (4.0.x, 4.1.x): Re: Core dump bug in ZSH version 3.0.7

[Bart Schaefer <schaefer@xxxxxxxxxxxxxxxx>]

On Nov 12,  6:59pm, Bart Schaefer wrote:
} Subject: Re: Core dump bug in ZSH version 3.0.7
}
} It doesn't crash 4.0.x/4.1.x, but it does get into a rather strange state,
} trying to read a here-document whose start/end string is a single space,
} which of course is impossible (so you're trapped in the here-document until
} you interrupt somehow).
} 
} zagzig% mask = (1 << string.atoi(sys.argv[1])) - 1
} zsh: parse error near `)'

At this point we've parsed this as the command "mask" with arguments "="
and "(1" and with here-document ending at "string.atoi(sys.argv[1])"; the
parse error is at the second parenthesis.

However, when zsh bailed out with the parse error, it failed to pop the
pending here-document off the queue of such documents.  So then when it
begins parsing this:

} zagzig% key = string.atoi(sys.argv[2])
} heredoc>  

Zsh now believes it is accepting input for the here-document started at
the previous command line.  4.0+ doesn't crash because it re-uses the
memory at which the here-document's name is pointing, so the document
merely seems to have a bogus name; 3.0.x crashes because the name pointer
in the here-document structure has become garbage.

The solution seems to be the following; I haven't checked whether it will
apply directly to 3.0.x, as this patch is based on 4.1.0-dev-2:

Index: Src/parse.c
===================================================================
--- Src/parse.c	2001/09/05 15:22:33	1.10
+++ Src/parse.c	2001/11/13 18:10:10
@@ -481,6 +481,11 @@
 	    return 0;
 	}
 	yyerror(1);
+	while (hdocs) {
+	    struct heredocs *next = hdocs->next;
+	    zfree(hdocs, sizeof(struct heredocs));
+	    hdocs = next;
+	}
 	herrflush();
 	if (noerrs != 2)
 	    errflag = 1;

-- 
Bart Schaefer                                 Brass Lantern Enterprises
http://www.well.com/user/barts              http://www.brasslantern.com

Zsh: http://www.zsh.org | PHPerl Project: http://phperl.sourceforge.net