Segfault because metafy() writes to a const char

[Theo Buehler <theo@xxxxxxxxxxxx>]

When trying to load a non-existent module with

% zmodload bla

both with zsh versions 5.0.5 and 5.0.7 on OpenBSD 5.7 (-current), zsh
crashes and dumps core.


Here's a backtrace of the crash

#0  0x0000176db68ab49f in metafy (buf=0x17700e20cfdf "File not found", len=14, heap=1) at utils.c:4116
4116        *e = '\0';
(gdb) bt
#0  0x0000176db68ab49f in metafy (buf=0x17700e20cfdf "File not found", len=14, heap=1) at utils.c:4116
#1  0x0000176db686ad2a in do_load_module (name=0x17702e8d7a38 "bla", silent=0) at module.c:1600
#2  0x0000176db686b9b8 in load_module (name=0x17702e8d7a38 "bla", enablesarr=0x0, silent=0)
    at module.c:2202
#3  0x0000176db686c523 in require_module (module=0x17702e8d7a38 "bla", features=0x0) at module.c:2335
#4  0x0000176db686dfc5 in bin_zmodload_load (nam=0x17702e8d7a28 "zmodload", args=0x17702e8d7a48,
    ops=0x7f7fffff9050) at module.c:2971
#5  0x0000176db686cce2 in bin_zmodload (nam=0x17702e8d7a28 "zmodload", args=0x17702e8d7a48,
    ops=0x7f7fffff9050, func=0) at module.c:2486
#6  0x0000176db6817ff0 in execbuiltin (args=0x17702e8d79e0, bn=0x176db6abb400) at builtin.c:450
#7  0x0000176db6835f19 in execcmd (state=0x7f7fffff9710, input=0, output=0, how=18, last1=2)
    at exec.c:3378
#8  0x0000176db6830e6f in execpline2 (state=0x7f7fffff9710, pcode=131, how=18, input=0, output=0, last1=0)
    at exec.c:1697
#9  0x0000176db68302a8 in execpline (state=0x7f7fffff9710, slcode=4098, how=18, last1=0) at exec.c:1484
#10 0x0000176db682f9e3 in execlist (state=0x7f7fffff9710, dont_change_job=0, exiting=0) at exec.c:1267
#11 0x0000176db682f309 in execode (p=0x17702e8d7918, dont_change_job=0, exiting=0,
    context=0x176db69b35d7 "toplevel") at exec.c:1073
#12 0x0000176db684f1bb in loop (toplevel=1, justonce=0) at init.c:185
#13 0x0000176db6852f1d in zsh_main (argc=1, argv=0x7f7fffff9898) at init.c:1638
#14 0x0000176db68174df in main (argc=1, argv=0x7f7fffff9898) at ./main.c:93
(gdb) %


The following patch fixes this problem for me, however, it effectively
undoes a patch discussed in this thread:


http://www.zsh.org/mla/workers/2013/msg01089.html

and, especially here:

http://www.zsh.org/mla/workers/2013/msg01091.html




--- Src/utils.c.orig    Wed Feb 18 15:32:20 2015
+++ Src/utils.c Wed Feb 18 15:32:44 2015
@@ -4069,7 +4069,7 @@ metafy(char *buf, int len, int heap)
            if (imeta(*e++))
                meta++;

-    if (meta || heap == META_DUP || heap == META_HEAPDUP) {
+    if (meta || heap == META_DUP || heap == META_HEAPDUP || *e != '\0') {
        switch (heap) {
        case META_REALLOC:
            buf = zrealloc(buf, len + meta + 1);
@@ -4112,8 +4112,8 @@ metafy(char *buf, int len, int heap)
                meta--;
            }
        }
+       *e = '\0';
     }
-    *e = '\0';
     return buf;
 }