From 74e6bc1905beb7124ab6a681762c2aa6ea20ce6e Mon Sep 17 00:00:00 2001 From: Mikael Magnusson Date: Wed, 6 May 2026 07:40:58 +0200 Subject: 54483: Make sure zleline is null-terminated One of these, not sure which, triggered a warning from valgrind: ==31255== Conditional jump or move depends on uninitialised value(s) ==31255== at 0x617D854: doinsert (zle_misc.c:51) ==31255== by 0x617DA8D: selfinsert (zle_misc.c:124) ==31255== by 0x617A51E: execzlefunc (zle_main.c:1492) ==31255== by 0x6179357: zlecore (zle_main.c:1152) ==31255== by 0x6179DFB: zleread (zle_main.c:1367) ==31255== by 0x617D05A: zle_main_entry (zle_main.c:2148) ==31255== by 0x45CD6B: zleentry (init.c:1779) ==31255== by 0x45E0B0: inputline (input.c:421) ==31255== by 0x45DEFE: ingetc (input.c:354) ==31255== by 0x44FD6C: ihgetc (hist.c:420) ==31255== by 0x46889F: gettok (lex.c:622) ==31255== by 0x467F2E: zshlex (lex.c:275) That code just does an innocuous zleline[zlecs] access, which many other places also do. --- ChangeLog | 4 ++++ Src/Zle/zle_hist.c | 1 + Src/Zle/zle_misc.c | 1 + Src/Zle/zle_params.c | 6 +++++- Src/Zle/zle_utils.c | 1 + Src/Zle/zle_vi.c | 1 + 6 files changed, 13 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index c0b46a914..586afa891 100644 --- a/ChangeLog +++ b/ChangeLog @@ -5,6 +5,10 @@ * 54480: Src/Zle/zle_vi.c: Wrong memcmp variant used in getvirange() + * 54483: Src/Zle/zle_hist.c, Src/Zle/zle_misc.c, + Src/Zle/zle_params.c, Src/Zle/zle_utils.c, Src/Zle/zle_vi.c: + Make sure zleline is null-terminated + 2026-05-10 Oliver Kiddle * unposted: Completion/Linux/Command/_selinux: complete files diff --git a/Src/Zle/zle_hist.c b/Src/Zle/zle_hist.c index 53c722621..af450fb43 100644 --- a/Src/Zle/zle_hist.c +++ b/Src/Zle/zle_hist.c @@ -867,6 +867,7 @@ pushlineoredit(char **args) ZS_memcpy(zleline, zhline, ics); zlell += ics; zlecs += ics; + zleline[zlell] = ZWC('\0'); free(zhline); } ret = pushline(args); diff --git a/Src/Zle/zle_misc.c b/Src/Zle/zle_misc.c index 3e50d5d4b..98a7fb093 100644 --- a/Src/Zle/zle_misc.c +++ b/Src/Zle/zle_misc.c @@ -1193,6 +1193,7 @@ quoteline(UNUSED(char **args)) sizeline(len); ZS_memcpy(zleline, str, len); zlecs = zlell = len; + zleline[zlell] = ZWC('\0'); return 0; } diff --git a/Src/Zle/zle_params.c b/Src/Zle/zle_params.c index 54019bf3b..31ba3bd56 100644 --- a/Src/Zle/zle_params.c +++ b/Src/Zle/zle_params.c @@ -247,8 +247,10 @@ set_buffer(UNUSED(Param pm), char *x) if(x) { setline(x, 0); zsfree(x); - } else + } else { viinsbegin = zlecs = zlell = 0; + zleline[zlell] = ZWC('\0'); + } fixsuffix(); menucmp = 0; } @@ -342,6 +344,7 @@ set_lbuffer(UNUSED(Param pm), char *x) ZS_memmove(zleline + len, zleline + zlecs, zlell - zlecs); ZS_memcpy(zleline, y, len); zlell = zlell - zlecs + len; + zleline[zlell] = ZWC('\0'); zlecs = len; zsfree(x); if (len) @@ -371,6 +374,7 @@ set_rbuffer(UNUSED(Param pm), char *x) else y = ZWS(""), len = 0; sizeline(zlell = zlecs + len); + zleline[zlell] = ZWC('\0'); ZS_memcpy(zleline + zlecs, y, len); zsfree(x); if (len) diff --git a/Src/Zle/zle_utils.c b/Src/Zle/zle_utils.c index 6e2456b1f..3d682ef2f 100644 --- a/Src/Zle/zle_utils.c +++ b/Src/Zle/zle_utils.c @@ -511,6 +511,7 @@ stringaszleline(char *instr, int incs, int *outll, int *outsz, int *outcs) if (outcs && inptr <= instr + incs) *outcs = outptr - outstr; *outll = outptr - outstr; + outstr[*outll] = ZWC('\0'); } else { *outstr = ZWC('\0'); *outll = 0; diff --git a/Src/Zle/zle_vi.c b/Src/Zle/zle_vi.c index 86543e172..58115beb9 100644 --- a/Src/Zle/zle_vi.c +++ b/Src/Zle/zle_vi.c @@ -236,6 +236,7 @@ getvirange(int wf) if (histline != hist1 || zlell != lastll || ZS_memcmp(zleline, lastline, zlell)) { histline = hist1; ZS_memcpy(zleline, lastline, zlell = lastll); + zleline[zlell] = ZWC('\0'); zlecs = pos; mark = mpos; virangeflag = 0; -- cgit v1.3.1