infinite loop in prompt expansion

[Laurent Wacrenier <lwa@xxxxxxxxx>]

Prompt truncation may enter in infinite loop within litteral escape
sequence :

% print -P %/
/home/lwa
% print -P '%{%80<..<%/%}'
/home/lwa
% print -P '%8<..<%/'
..me/lwa
% print -P '%{%8<..<%/%}'
(don't give the hand back and spend all CPU time)

Tested on zsh 3.1.9 and 4.0.6

GDB output :

prompttrunc (arg=6, truncchar=134574132, doprint=1, endchar=0) at prompt.c:852
852                             if (*p == Inpar)
(gdb) where
#0  prompttrunc (arg=6, truncchar=134574132, doprint=1, endchar=0)
    at prompt.c:852
#1  0x280c0685 in putpromptchar (doprint=1, endchar=0) at prompt.c:443
#2  0x280bfcfc in promptexpand (s=0x80639a0 "%{%8<..<%/%}", ns=0, 
    rs=0x61 <Error reading address 0x61: Bad address>, 
    Rs=0x61 <Error reading address 0x61: Bad address>) at prompt.c:177
#3  0x2807eb8c in bin_print (name=0x8063970 "print", args=0xbfbff110, 
    ops=0xbfbff160 "", func=13) at builtin.c:2917
#4  0x2807768d in execbuiltin (args=0x8063940, bn=0x280db16c) at builtin.c:367
#5  0x2808889d in execcmd (state=0xbfbff470, input=0, output=0, how=18, 
    last1=2) at exec.c:2296
#6  0x28085cf4 in execpline2 (state=0xbfbff470, pcode=259, how=18, input=0, 
    output=0, last1=0) at exec.c:1201
#7  0x2808536d in execpline (state=0xbfbff470, slcode=97, how=18, last1=0)
    at exec.c:991
#8  0x28084d3a in execlist (state=0xbfbff470, dont_change_job=0, exiting=0)
    at exec.c:826
#9  0x28084a5f in execode (p=0x61, dont_change_job=97, exiting=97)
    at exec.c:729
#10 0x280987b4 in loop (toplevel=1, justonce=0) at init.c:165
#11 0x2809b054 in zsh_main (argc=1, argv=0xbfbff544) at init.c:1215
#12 0x0804852b in exit ()
#13 0x08048455 in exit ()
(gdb) s
857                             else if (w) {
(gdb) 
852                             if (*p == Inpar)
(gdb) 
857                             else if (w) {
(gdb) 
852                             if (*p == Inpar)
(gdb) 
857                             else if (w) {
(gdb) 
852                             if (*p == Inpar)
(gdb) print p
$1 = 0x8057034 "\211"
(gdb) print w
$2 = 0