Stack overflow with extended globs

[Christian Neukirchen <chneukirchen@xxxxxxxxx>]

Discussion in #zsh turned up this yesterday:

% gdb --args zsh -f
(gdb) r
Starting program: /bin/zsh -f
juno% echo $ZSH_VERSION 
5.0.2
juno% setopt extendedglob; echo *(#c3,)x*

Program received signal SIGSEGV, Segmentation fault.
0x000000000046ddad in ?? ()
(gdb) bt -30
#38793 0x000000000046e199 in ?? ()
#38794 0x000000000046e921 in ?? ()
#38795 0x000000000046e199 in ?? ()
#38796 0x000000000046e921 in ?? ()
#38797 0x000000000046e199 in ?? ()
#38798 0x000000000046e921 in ?? ()
#38799 0x000000000046e199 in ?? ()
#38800 0x000000000046e921 in ?? ()
#38801 0x000000000046e199 in ?? ()
#38802 0x000000000046e921 in ?? ()
#38803 0x000000000046e199 in ?? ()
#38804 0x000000000046e921 in ?? ()
#38805 0x000000000046e199 in ?? ()
#38806 0x000000000046e921 in ?? ()
#38807 0x000000000046e199 in ?? ()
#38808 0x000000000046dc91 in ?? ()
#38809 0x000000000046f12d in pattryrefs ()
#38810 0x000000000046f7f7 in pattry ()
#38811 0x0000000000431edb in ?? ()
#38812 0x000000000043301a in zglob ()
#38813 0x0000000000477656 in globlist ()
#38814 0x000000000042a2a6 in ?? ()
#38815 0x000000000042b866 in ?? ()
#38816 0x000000000042bdaf in ?? ()
#38817 0x000000000042cf5f in execlist ()
#38818 0x000000000042d47d in execode ()
#38819 0x000000000043d972 in loop ()
#38820 0x0000000000440b1e in zsh_main ()
#38821 0x00007ffff70eaa15 in __libc_start_main () from /usr/lib/libc.so.6
#38822 0x000000000040f3d1 in _start ()

-- 
Christian Neukirchen  <chneukirchen@xxxxxxxxx>  http://chneukirchen.org