Hello,
Simply running zsh (from git) on each of the two attached files causes a
free() error for me:
*** Error in `/usr/local/bin/zsh': free(): invalid next size (fast): 0x00000000009708c0 ***
This has been found fuzzing using AFL: http://lcamtuf.coredump.cx/afl/
Dennis
gdb output:
Program received signal SIGABRT, Aborted.
0x00007ffff6eeb5e7 in raise () from /lib64/libc.so.6
(gdb) bt
#0 0x00007ffff6eeb5e7 in raise () from /lib64/libc.so.6
#1 0x00007ffff6eec9c8 in abort () from /lib64/libc.so.6
#2 0x00007ffff6f2a0d4 in __libc_message () from /lib64/libc.so.6
#3 0x00007ffff6f2f9fe in malloc_printerr () from /lib64/libc.so.6
#4 0x00007ffff6f30716 in _int_free () from /lib64/libc.so.6
#5 0x00000000006fccfd in unmeta (file_name=0x7fffffffc1d0 "/media/intel/vtune_amplifier_xe_2011/bin64/d\203")
at utils.c:4238
#6 0x0000000000473137 in iscom (s=0x7fffffffc1d0 "/media/intel/vtune_amplifier_xe_2011/bin64/d\203")
at exec.c:824
#7 hashcmd (arg0=0x7ffff7ff3560 "d\203", pp=0x969168, pp@entry=0x969160) at exec.c:878
#8 0x0000000000489575 in execcmd (state=0x7fffffffd820, input=0, output=0, how=<optimized out>, last1=2)
at exec.c:2886
#9 0x000000000049059e in execpline2 (state=0x7fffffffd820, pcode=16729, pcode@entry=131, how=18, input=0,
output=0, last1=5798544, last1@entry=0) at exec.c:1698
#10 0x0000000000491294 in execpline (state=state@entry=0x7fffffffd820, slcode=<optimized out>,
how=how@entry=18, last1=<optimized out>) at exec.c:1485
#11 0x00000000004952ab in execlist (state=state@entry=0x7fffffffd820, dont_change_job=dont_change_job@entry=0,
exiting=exiting@entry=0) at exec.c:1268
#12 0x0000000000495ce7 in execode (p=0x7ffff7ff33f0, dont_change_job=0, exiting=0, context=0x72a141 "toplevel")
at exec.c:1074
#13 0x0000000000515861 in loop (toplevel=1, justonce=0) at init.c:185
#14 zsh_main (argc=<optimized out>, argv=<optimized out>) at init.c:1649
#15 0x00007ffff6ed7dc5 in __libc_start_main () from /lib64/libc.so.6
#16 0x0000000000413829 in _start ()
Attachment:
id:000000,sig:06,src:000000,op:havoc,rep:16
Description: Binary data
Attachment:
id:000001,sig:06,src:000002,op:havoc,rep:8
Description: Binary data