Re: free() error on simple input scripts

["Jun T." <takimoto-j@xxxxxxxxxxxxxxxxx>]

After the commit
48cd1b6c3b51a7bc6d45d4aeb7ff8c55d97a6f2a
    33894: boundary conditions in unmeta(), unmetafy()

test D07multibyte fails on my Mac as follows:

./D07multibyte.ztst: starting.
Testing multibyte with locale en_US.UTF-8
Test ./D07multibyte.ztst failed: bad status 134, expected 0 from:
  mkdir 梶浦由記 'Пётр Ильич Чайковский'
  (cd 梶浦由記; print ${${(%):-%~}:t})
  (cd 'Пётр Ильич Чайковский'; print ${${(%):-%~}:t})
Error output:
zsh(74285,0x7fff72bb3310) malloc: *** error for object 0x7f8162504998: incorrect checksum for freed object - object was probably modified after being freed.
*** set a breakpoint in malloc_error_break to debug
Was testing: Metafied characters in prompt expansion
./D07multibyte.ztst: test failed.

It seems the problem is in the following hunk:

> @@ -4208,8 +4208,10 @@ unmeta(const char *file_name)
> 
>     meta = 0;
>     for (t = file_name; *t; t++) {
> -	if (*t == Meta)
> -	    meta = 1;
> +	if (*t == Meta) {
> +	    meta = t[1];
> +	    break;
> +	}
>     }

Breaking out of the for-loop leaves the pointer t at the first Meta
in file_name, and the value of newsz becomes too small.

How about the following?

diff --git a/Src/utils.c b/Src/utils.c
index 5c90638..ab3d3da 100644
--- a/Src/utils.c
+++ b/Src/utils.c
@@ -4208,10 +4208,8 @@ unmeta(const char *file_name)
     
     meta = 0;
     for (t = file_name; *t; t++) {
-	if (*t == Meta) {
-	    meta = t[1];
-	    break;
-	}
+	if (*t == Meta)
+	    meta = 1;
     }
     if (!meta) {
 	/*
@@ -4250,7 +4248,7 @@ unmeta(const char *file_name)
     }
 
     for (t = file_name, p = fn; *t; p++)
-	if ((*p = *t++) == Meta)
+	if ((*p = *t++) == Meta && *t)
 	    *p = *t++ ^ 32;
     *p = '\0';
     return fn;