Re: zsh 5.0.5-dev-2

[Han Pingtian <hanpt@xxxxxxxxxxxxxxxxxx>]

On Sun, Aug 17, 2014 at 11:36:19PM -0700, Bart Schaefer wrote:
> On Aug 18, 10:56am, Han Pingtian wrote:
> } Subject: Re: zsh 5.0.5-dev-2
> }
> } On Sun, Aug 17, 2014 at 10:30:30AM -0700, Bart Schaefer wrote:
> } > 
> } > I suspect Fortify is reporting a potential error rather than a real
> } > one, because we'd presumably have seen other problems before this if
> } > "cd .." actually caused an 8kb buffer on the stack to overflow.
> } 
> } I have tried to print the length of xbuf and *pp before the sprintf().
> } Looks like when overflow being triggered, the length of xbuf is 8188,
> } and the length of *pp is 10.
> 
> I now suspect you've deliberately constructed and (with chaselinks not
> set?) cd'd one level down at a time into a path that's at least 8188
> characters long, and then setopt chaselinks and done "cd .." from the
> bottom directory in that path.  Is that correct?
> 
Sorry for the confusing. I found this problem with this command which
comes from 32274:

    % for i in `seq 1000`; do mkdir 0123456789; cd 0123456789; done; cd ..

And the filesystem is tmpfs. I don't set chaselinks, but looks like it
will be set within cd_try_chdir():

1119     if (!chasinglinks)
1120         dochaselinks = fixdir(buf);
... ...
1134     if (dochaselinks)
1135         chasinglinks = 1;

then xsymlink() will be called.