54705: ksh93: fix use after free of .sh.edchar

% bindkey T foo
% zle -N foo
% foo() { emulate -L ksh; () { zle -M ${.sh.edchar} } }
% zmodload zsh/ksh93
% [press T twice]
\M-(\M-^Ak\M-<\M-G^?

or alternatively, emulate ksh in the main shell and just define this,
but then you have to make sure you're in a zsh -f shell so random things
aren't entering functions in the background.
% foo() { zle -M ${.sh.edchar} }

the code tries to restore sh_edchar = sh_unsetval; in the else branch,
but this doesn't ever run in the above scenario because we never enter
or leave a function with ksh emulation enabled (or indeed at all).

1 files changed, 3 insertions, 0 deletions

diff --git a/ChangeLog b/ChangeLog
index ec5d72124..a130d22cc 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,8 @@
 2026-06-10  Mikael Magnusson  <mikachu@gmail.com>
 
+	* 54705: Src/Modules/ksh93.c: ksh93: fix use after free of
+	.sh.edchar
+
 	* 54704 + 54728: Src/Modules/ksh93.c: remove obsolete workaround
 	in ksh93 module