segfault on 'echo $(< /dev/kmsg )' in zsh-5.0.2 and git

[Marien Zwart <marien.zwart@xxxxxxxxx>]

Hello zsh-workers,

On zsh-5.0.2 as well as current git
(40a881569fed17177fbd73079dd4d3849517567c), the following segfaults on
my linux 3.10, glibc 2.17 system:

echo $(< /dev/kmsg )

Tracing through it in gdb, I've found that's because the fdopen(in,
"r") call in readoutput returned NULL (and then it predictably
segfaults somewhere in the subsequent fgetc). Sticking a NULL check
and zerr("fdopen: %e", errno); after the fdopen gets me "zsh: fdopen:
invalid argument", and returning NULL after that at least doesn't make
zsh immediately topple over. But I have no idea how safe that is
(there's no other error return in readoutput), and it needs some
tidying up such as closing the fd, so I'll leave properly patching
this to someone else.

That's assuming fdopen failing is considered possible. In this case,
it happens because /dev/kmsg supports seek but not with whence
SEEK_CUR, for which it fails with EINVAL (lseek(2) says "whence is not
valid" is one condition resulting in EINVAL), and glibc accepts that
seek failing with ESPIPE but not other reasons. Depending on which
manpage you read fdopen() may fail if fcntl fails, which it may do for
various reasons. So if it's not too hard it'd be nice for zsh to
survive fdopen failing, although there's something to be said for
fdopen (glibc) or the fd (linux kernel) being broken for this specific
crash (on /dev/kmsg).

-- 
Marien Zwart (marienz on freenode).