diff options
| author | Mikael Magnusson <mikachu@gmail.com> | 2026-05-22 23:30:48 +0200 |
|---|---|---|
| committer | Mikael Magnusson <mikachu@gmail.com> | 2026-05-25 07:05:09 +0200 |
| commit | f8ecad1a27bec735af27f965b0c836d36c9b37c7 (patch) | |
| tree | 42232c72e53844803e00e35fc840e1b4623b63fd /Completion/Unix/Command | |
| parent | 54592: fix two dead assignments reported 15 years ago by clang (diff) | |
| download | zsh-f8ecad1a27bec735af27f965b0c836d36c9b37c7.tar zsh-f8ecad1a27bec735af27f965b0c836d36c9b37c7.tar.gz zsh-f8ecad1a27bec735af27f965b0c836d36c9b37c7.tar.bz2 zsh-f8ecad1a27bec735af27f965b0c836d36c9b37c7.tar.lz zsh-f8ecad1a27bec735af27f965b0c836d36c9b37c7.tar.xz zsh-f8ecad1a27bec735af27f965b0c836d36c9b37c7.tar.zst zsh-f8ecad1a27bec735af27f965b0c836d36c9b37c7.zip | |
54593: fix two edge cases in join_strs
int alloclen = (convlen > 20) ? convlen : 20;
This allocates exactly enough room for the bytes returned by
zlelineasstring, but not the nul terminator. However, rr is only ever 0
on the first entry to this function, so it probably won't ever hit this
case by accident.
You *can* trigger it though, if you really want to:
zsh% ls
foo-bar foo_bar
zsh% autoload compinit; compinit
zsh% zstyle '*' matcher-list 'r:|[_-]=* m:AAAAAAAAAAAAAAAAAAAAAA={-_}'
zsh% foo foo<tab>
==31891== Invalid write of size 1
==31891== at 0x4873C7F: join_strs (compmatch.c:2098)
==31891== by 0x4873E47: cmp_anchors (compmatch.c:2131)
==31891== by 0x487603B: join_clines (compmatch.c:2909)
==31891== by 0x486CE5F: add_match_data (compcore.c:3003)
==31891== by 0x486AECE: addmatches (compcore.c:2556)
==31891== by 0x4860B5B: bin_compadd (complete.c:848)
==31891== Address 0x7316f46 is 0 bytes after a block of size 22 alloc'd
==31891== at 0x48396C5: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
==31891== by 0x4873AAA: join_strs (compmatch.c:2055)
==31891== by 0x4873E47: cmp_anchors (compmatch.c:2131)
The !rp check at the end won't be hit from any of the current callers of
the function, but it makes both me and the static analyzers feel better
if we check it.
Diffstat (limited to 'Completion/Unix/Command')
0 files changed, 0 insertions, 0 deletions
