zsh heredoc crash

[Paulo César Pereira de Andrade <paulo.cesar.pereira.de.andrade@xxxxxxxxx>]

  Hi,

  zsh (tested on 5.0.2) can be made to crash with a pattern
like this:

---8<---
#!/usr/bin/zsh

cat >> /tmp/try <<EOF
export A="$(tr '\n' ' ' <<BLDARC
content
BLDARC)"
EOF
---8<---

  It will also crash with a simpler (but wrong) version:
---8<---
cat >> /tmp/try <<EOF
foo
EOF)
---8<---

  With this patch:
---8<---
diff -up zsh-5.0.2/Src/exec.c.orig zsh-5.0.2/Src/exec.c
--- zsh-5.0.2/Src/exec.c.orig    2016-09-06 15:10:19.394565181 -0300
+++ zsh-5.0.2/Src/exec.c    2016-09-06 15:10:36.300551444 -0300
@@ -3631,16 +3631,16 @@ gethere(char **strp, int typ)
     *bptr++ = '\n';
     }
     *t = '\0';
+    s = dupstring(buf);
+    zfree(buf, bsiz);
     if (!qt) {
     int ef = errflag;

-    parsestr(buf);
+    parsestr(s);

     if (!errflag)
         errflag = ef;
     }
-    s = dupstring(buf);
-    zfree(buf, bsiz);
     return s;
 }

---8<---
it will just print something like:
/tmp/a.sh:8: parse error

  The problem is that the buf vector is allocated with
zalloc, and when calling parsestr it will call hrealloc
on the zalloc'ed buffer.

  The patch just works around the crash, but a better
error message may be shown for this pattern. Ksh
allows it silently, and bash prints a warning but also
allow it.

  The workaround in the script would be to not add
anything after the heredoc delimiter.

Thanks,
Paulo