Crash when undoing pasted text when bracketed-paste-magic is enabled

[Lukáš Zaoral <lzaoral@xxxxxxxxxx>]

Hello!

I’ve recently received a bug report about zsh crashing on Fedora and I was able
to reduce it to the following reproducer applicable to both 5.9.2 and the latest
master:

Reproducer:

$ cat .zshrc
bindkey "^_" undo
autoload -Uz bracketed-paste-magic
zle -N bracketed-paste bracketed-paste-magic
$ ZDOTDIR=$PWD zsh
% 
// First input some random text, then paste another piece of text using ctrl+shift+v,
// then undo that with ctrl+_ couple of times.
zsh: segmentation fault (core dumped)

Backtrace (master on aarch64 Fedora 44, but the bt is the same as on intel):

(gdb) bt
#0  __memcpy_generic () at ../sysdeps/aarch64/multiarch/../memcpy.S:127
#1  0x0000ffff7f5cbb8c in setlastline () at zle_utils.c:1600
#2  0x0000ffff7f5cbce0 in undo (args=0xffff7f5f76c0 <zlenoargs>) at zle_utils.c:1635
#3  0x0000ffff7f5a6160 in execzlefunc (func=0xffff7f5f41b8 <thingies+4400>, args=0xffff7f5f76c0 <zlenoargs>, set_bindk=0, set_lbindk=0)
    at zle_main.c:1488
#4  0x0000ffff7f5a4f04 in zlecore () at zle_main.c:1151
#5  0x0000ffff7f5a5ae0 in zleread (lp=0x52fc20 <prompt>, rp=0x0, flags=3, context=0, init=0xffff7f5d83c0 "zle-line-init",
    finish=0xffff7f5d83d0 "zle-line-finish") at zle_main.c:1366
#6  0x0000ffff7f5a8eb4 in zle_main_entry (cmd=1, ap=...) at zle_main.c:2145
#7  0x0000000000464890 in zleentry (cmd=1) at init.c:1813
#8  0x0000000000465f5c in inputline () at input.c:421
#9  0x0000000000465d34 in ingetc () at input.c:354
#10 0x00000000004548d8 in ihgetc () at hist.c:420
#11 0x0000000000472f64 in gettok () at lex.c:622
#12 0x00000000004720b0 in zshlex () at lex.c:275
#13 0x00000000004a0dbc in parse_event (endtok=37) at parse.c:619
#14 0x000000000045f894 in loop (toplevel=1, justonce=0) at init.c:167
#15 0x0000000000464dbc in zsh_main (argc=1, argv=0xffffce54f818) at init.c:1966
#16 0x000000000040ff48 in main (argc=1, argv=0xffffce54f818) at ./main.c:93
(gdb) up
#1  0x0000ffff7f5cbb8c in setlastline () at zle_utils.c:1600
1600	    ZS_memcpy(lastline, zleline, (lastll = zlell));
(gdb) p linesz
$2 = 0

For some reason linesz gets set to zero and glibc’s implementation of realloc(ptr, 0)
always returns a NULL pointer which leads to the segmentation fault because lastline is NULL.

Thank you!

Regards,
Lukas