Crash with long path depths

[Matt Johnston <matt@xxxxxxxxxx>]

I've come across a crash in zsh with very (excessively) long
path depths.

Steps to reproduce:

for i in {1..2000}; do mkdir z$i || break; cd z$i; echo $i ;done
cd ..

and it segfaults.

I can reproduce it with zsh 4.2.3 (powerpc-apple-darwin8.0)
and zsh 4.2.5 (x86_64-unknown-linux-gnu).

A darwin crash log from two separate crashes follows, I can
provide more details/testing as required. I realise it's not
a very realistic scenario, though generally segfaults
indicate something bad happening.

Cheers,
Matt


**********

OS Version:     10.4.2 (Build 8C46)
Report Version: 3

Command: zsh
Path:    /bin/zsh
Parent:  xterm [1456]

Version: ??? (???)

PID:    1458
Thread: 0

Exception:  EXC_BAD_ACCESS (0x0001)
Codes:      KERN_INVALID_ADDRESS (0x0001) at 0x332f7a50

Thread 0 Crashed:
0   zsh 	0x00022414 hbegin + 672
1   zsh 	0x00026658 loop + 88
2   zsh 	0x00029470 zsh_main + 596
3   zsh 	0x00001d18 start + 412
4   zsh 	0x00001bb8 start + 60

Thread 0 crashed with PPC Thread State 64:
  srr0: 0x0000000000022414 srr1: 0x000000000200f030                        vrsave: 0x0000000000000000
    cr: 0x44004444          xer: 0x0000000000000004   lr: 0x000000000002234c  ctr: 0x00000000900040e0
    r0: 0x0000000000000000   r1: 0x00000000bffffa90   r2: 0x00000000000769f0   r3: 0x0000000000334100
    r4: 0x0000000000000001   r5: 0x0000000000000001   r6: 0x0000000000402686   r7: 0x0000000000000008
    r8: 0x0000000000000001   r9: 0x00000000000208b8  r10: 0x0000000000400682  r11: 0x0000000044004440
   r12: 0x0000000090003abc  r13: 0x0000000000000000  r14: 0x0000000000000000  r15: 0x0000000000000000
   r16: 0x0000000000000000  r17: 0x0000000000000000  r18: 0x0000000000000000  r19: 0x0000000000000000
   r20: 0x0000000000000000  r21: 0x000000000007660c  r22: 0x0000000000000001  r23: 0x000000000007660c
   r24: 0x0000000000000001  r25: 0x0000000000000000  r26: 0x0000000000303120  r27: 0x0000000000093150
   r28: 0x0000000000000001  r29: 0x00000000332f7a34  r30: 0x0000000000076a54  r31: 0x000000000002217c

Binary Images Description:
    0x1000 -    0x6dfff zsh 	/bin/zsh
   0x97000 -    0xb8fff zle.so 	/usr/lib/zsh/4.2.3/zsh/zle.so
   0xc6000 -    0xc8fff rlimits.so 	/usr/lib/zsh/4.2.3/zsh/rlimits.so
   0xcb000 -    0xe1fff complete.so 	/usr/lib/zsh/4.2.3/zsh/complete.so
   0xe7000 -    0xebfff zutil.so 	/usr/lib/zsh/4.2.3/zsh/zutil.so
   0xee000 -    0xf2fff parameter.so 	/usr/lib/zsh/4.2.3/zsh/parameter.so
  0x205000 -   0x20efff complist.so 	/usr/lib/zsh/4.2.3/zsh/complist.so
  0x212000 -   0x21dfff computil.so 	/usr/lib/zsh/4.2.3/zsh/computil.so
0x8fe00000 - 0x8fe51fff dyld 43.1	/usr/lib/dyld
0x90000000 - 0x901a6fff libSystem.B.dylib 	/usr/lib/libSystem.B.dylib
0x901fe000 - 0x90202fff libmathCommon.A.dylib 	/usr/lib/system/libmathCommon.A.dylib
0x92ca2000 - 0x92d90fff libiconv.2.dylib 	/usr/lib/libiconv.2.dylib
0x9687f000 - 0x968adfff libncurses.5.4.dylib 	/usr/lib/libncurses.5.4.dylib

**********

OS Version:     10.4.2 (Build 8C46)
Report Version: 3

Command: zsh
Path:    /bin/zsh
Parent:  xterm [2423]

Version: ??? (???)

PID:    2429
Thread: 0

Exception:  EXC_BAD_ACCESS (0x0001)
Codes:      KERN_INVALID_ADDRESS (0x0001) at 0x3436392f

Thread 0 Crashed:
0   zsh 	0x000049d0 cd_able_vars + 1004
1   zsh 	0x00003e00 bin_cd + 464
2   zsh 	0x00002cc4 execbuiltin + 1436
3   zsh 	0x00015838 execsubst + 7144
4   zsh 	0x00012d14 execlist + 4816
5   zsh 	0x000122a0 execlist + 2140
6   zsh 	0x00011c38 execlist + 500
7   zsh 	0x00011888 execode + 68
8   zsh 	0x000268a4 loop + 676
9   zsh 	0x00029470 zsh_main + 596
10  zsh 	0x00001d18 start + 412
11  zsh 	0x00001bb8 start + 60

Thread 0 crashed with PPC Thread State 64:
  srr0: 0x00000000000049d0 srr1: 0x000000000200f030                        vrsave: 0x0000000000000000
    cr: 0x28022424          xer: 0x0000000020000004   lr: 0x00000000000049ac  ctr: 0x0000000000000001
    r0: 0x000000000000002f   r1: 0x00000000bffff450   r2: 0x000000003436392f   r3: 0x0000000001800000
    r4: 0x000000000182a000   r5: 0x0000000000000010   r6: 0x00000000fefefeff   r7: 0x0000000000000002
    r8: 0x000000007a380000   r9: 0x000000000180003c  r10: 0x000000000000357b  r11: 0x0000000001823a00
   r12: 0x00000000900060ac  r13: 0x0000000000000001  r14: 0x0000000000000000  r15: 0x0000000000000000
   r16: 0x0000000000000000  r17: 0x00000000bffff620  r18: 0x0000000000093200  r19: 0x00000000bffff600
   r20: 0x000000000006e1f0  r21: 0x0000000000000001  r22: 0x0000000000073c38  r23: 0x00000000bffff620
   r24: 0x0000000000073c38  r25: 0x00000000000748cc  r26: 0x000000000000000a  r27: 0x0000000001830200
   r28: 0x00000000000748cc  r29: 0x000000000182a000  r30: 0x00000000000748cc  r31: 0x00000000000048cc

Binary Images Description:
    0x1000 -    0x6dfff zsh 	/bin/zsh
   0x97000 -    0xb8fff zle.so 	/usr/lib/zsh/4.2.3/zsh/zle.so
   0xc6000 -    0xc8fff rlimits.so 	/usr/lib/zsh/4.2.3/zsh/rlimits.so
   0xcb000 -    0xe1fff complete.so 	/usr/lib/zsh/4.2.3/zsh/complete.so
   0xe7000 -    0xebfff zutil.so 	/usr/lib/zsh/4.2.3/zsh/zutil.so
   0xee000 -    0xf2fff parameter.so 	/usr/lib/zsh/4.2.3/zsh/parameter.so
  0x205000 -   0x20efff complist.so 	/usr/lib/zsh/4.2.3/zsh/complist.so
  0x212000 -   0x21dfff computil.so 	/usr/lib/zsh/4.2.3/zsh/computil.so
0x8fe00000 - 0x8fe51fff dyld 43.1	/usr/lib/dyld
0x90000000 - 0x901a6fff libSystem.B.dylib 	/usr/lib/libSystem.B.dylib
0x901fe000 - 0x90202fff libmathCommon.A.dylib 	/usr/lib/system/libmathCommon.A.dylib
0x92ca2000 - 0x92d90fff libiconv.2.dylib 	/usr/lib/libiconv.2.dylib
0x9687f000 - 0x968adfff libncurses.5.4.dylib 	/usr/lib/libncurses.5.4.dylib