Re: ZSH-Bug (?): glibc, "double-free or corruption"

[Peter Stephenson <pws@xxxxxxx>]

Jonas Kramer <jonas.kramer@xxxxxxx> wrote:
> Hi,
> 
> I think I found a bug here. I'm just writing a CGI page in ZSH script 
> and the server (lighttpd 1.4.7) kills my script and logs messages like 
> the followings to the error log file:

> The relevant source in init.z is the following:
> 
> typeset -A POST
> if [ $CONTENT_LENGTH -gt 0 ]; then
>   read -n 0 -k $CONTENT_LENGTH BUF

As you pointed out, the -n should be -u.  I think the -n itself is simply
ignored if -c wasn't present.

The interpretation of the code as it stands is that all the arguments
from 0 onward are treated as parameter names, i.e. 0 -k $CONTENT_LENGTH
BUF.

Assigning to 0 is allowed; this changes $0, the script or function name.

If there are at least 2 fields, it will try to assign to -k.  This should
produce an error message.

$CONTENT_LENGTH is the interesting one.  It will try to assign the field to
the $CONTENT_LENGTH'th positional parameter.  If this is a large number,
you can get a huge positional array; but given this is supposed to be a
maximum byte size for the read builtin it doesn't actually look like that
will be a problem.  If you later do something with $* or $@ or loop using
$# you might have problems.

BUF will be unproblematic.

So I'm not really sure where your error messages were coming from.

>   IFS="\r\n"
>   for LINE in ($(print $BUF)); do

There's an idiom for this in zsh, it's so common:

   for LINE in ${(f)BUF}; do

This just handles newlines, so you may end up needing to strip carriage
returns:

  for LINE in ${${(f)BUF}%%$'\r'}; do

You shouldn't need the outer parentheses in any case.

>     IFS="="
>     X=($(print $LINE))

Again, you can split into words without using IFS or an extra process:

    X=(${(s.=.)LINE})

-- 
Peter Stephenson <pws@xxxxxxx>                  Software Engineer
CSR PLC, Churchill House, Cambridge Business Park, Cowley Road
Cambridge, CB4 0WZ, UK                          Tel: +44 (0)1223 692070


Your mail client is unable to display the latest news from CSR. To access our news copy this link into a web browser:  http://www.csr.com/email_sig.html