Re: Another Zsh parser segmentation fault (heredoc)

[Peter Stephenson <p.stephenson@xxxxxxxxxxx>]

On Mon, 8 May 2017 08:49:49 -0500
Eduardo Bustamante <dualbus@xxxxxxxxx> wrote:
> dualbus@debian:~/src/zsh/zsh$ git rev-parse HEAD
> f25d01a97c61fdac5d6e0a6a8fb63b5b2b5f3393
> 
> dualbus@debian:~/bash-fuzzing/zsh-parser$ cat -v getredirs
> 0 {^X}<<0

That's an ASCII character 24 but any single non-identifier character
triggers the underlying bug.

There's an off-by-one in the test for the argument, or, to use the
technical phrase, crap programming.

This isn't a syntax error as the {varid} syntax was added quite late, so
it errs on the side of leaving irrelevant arguments alone.

pws

diff --git a/Src/parse.c b/Src/parse.c
index b0de9a8..8769baa 100644
--- a/Src/parse.c
+++ b/Src/parse.c
@@ -1836,7 +1836,7 @@ par_simple(int *cmplx, int nr)
 
 		if (*ptr == Outbrace && ptr > tokstr + 1)
 		{
-		    if (itype_end(tokstr+1, IIDENT, 0) >= ptr - 1)
+		    if (itype_end(tokstr+1, IIDENT, 0) >= ptr)
 		    {
 			char *toksave = tokstr;
 			char *idstring = dupstrpfx(tokstr+1, eptr-tokstr-1);
diff --git a/Test/A04redirect.ztst b/Test/A04redirect.ztst
index 2671080..cb82751 100644
--- a/Test/A04redirect.ztst
+++ b/Test/A04redirect.ztst
@@ -165,6 +165,15 @@
 ?About to close a second time
 *?\(eval\):*: failed to close file descriptor *
 
+  eval $'fn-varid() { print {\x18}<<0 }'
+  { which -x2 fn-varid; fn-varid } | tr $'\x18' '?'
+0:Regression test for off-by-one in varid check
+>fn-varid () {
+>  print {?} <<0
+>0
+>}
+>{?}
+
   print foo >&-
 0:'>&-' redirection