The following seems to cause some sort of recursive expansion:
dualbus@debian:~/bash-fuzzing/zsh-parser$ cat -v xsymlinks
${(r0$0)}
$_:P
dualbus@debian:~/bash-fuzzing/zsh-parser$ md5sum xsymlinks
22377c2c7d97ac88633232eb8df12a6e xsymlinks
dualbus@debian:~/bash-fuzzing/zsh-parser$ base64 xsymlinks
JHsocjAkMCl9CiRfOlA=
dualbus@debian:~/bash-fuzzing/zsh-parser$ zsh -n xsymlinks
*** buffer overflow detected ***: zsh terminated
======= Backtrace: =========
/lib/x86_64-linux-gnu/libc.so.6(+0x70bcb)[0x7f0b7e9d0bcb]
/lib/x86_64-linux-gnu/libc.so.6(__fortify_fail+0x37)[0x7f0b7ea59037]
/lib/x86_64-linux-gnu/libc.so.6(+0xf7170)[0x7f0b7ea57170]
/lib/x86_64-linux-gnu/libc.so.6(+0xf6729)[0x7f0b7ea56729]
/lib/x86_64-linux-gnu/libc.so.6(_IO_default_xsputn+0xac)[0x7f0b7e9d4bdc]
/lib/x86_64-linux-gnu/libc.so.6(_IO_vfprintf+0x1ebb)[0x7f0b7e9a8bbb]
/lib/x86_64-linux-gnu/libc.so.6(__vsprintf_chk+0x8c)[0x7f0b7ea567bc]
/lib/x86_64-linux-gnu/libc.so.6(__sprintf_chk+0x7d)[0x7f0b7ea5670d]
zsh(+0x96be9)[0x56306ea28be9]
zsh(xsymlink+0x1d)[0x56306ea2a6ed]
zsh(modify+0xa1f)[0x56306ea1b86f]
zsh(+0x8b9cb)[0x56306ea1d9cb]
zsh(prefork+0xc1)[0x56306ea21ea1]
zsh(+0x3117a)[0x56306e9c317a]
zsh(+0x33e02)[0x56306e9c5e02]
zsh(+0x3420c)[0x56306e9c620c]
zsh(execlist+0x724)[0x56306e9c7b74]
zsh(execode+0x99)[0x56306e9c7fd9]
zsh(loop+0x349)[0x56306e9dc099]
zsh(zsh_main+0x4f6)[0x56306e9df826]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf1)[0x7f0b7e9802b1]
zsh(_start+0x2a)[0x56306e9a933a]
======= Memory map: ========
56306e992000-56306ea53000 r-xp 00000000 fe:01 21889063
/bin/zsh
56306ec52000-56306ec54000 r--p 000c0000 fe:01 21889063
/bin/zsh
56306ec54000-56306ec5a000 rw-p 000c2000 fe:01 21889063
/bin/zsh
56306ec5a000-56306ec6e000 rw-p 00000000 00:00 0
56306fb06000-56306fb45000 rw-p 00000000 00:00 0 [heap]
7f0b7df0b000-7f0b7df21000 r-xp 00000000 fe:01 1310784
/lib/x86_64-linux-gnu/libgcc_s.so.1
7f0b7df21000-7f0b7e120000 ---p 00016000 fe:01 1310784
/lib/x86_64-linux-gnu/libgcc_s.so.1
7f0b7e120000-7f0b7e121000 r--p 00015000 fe:01 1310784
/lib/x86_64-linux-gnu/libgcc_s.so.1
7f0b7e121000-7f0b7e122000 rw-p 00016000 fe:01 1310784
/lib/x86_64-linux-gnu/libgcc_s.so.1
7f0b7e122000-7f0b7e12c000 r-xp 00000000 fe:01 1311265
/lib/x86_64-linux-gnu/libnss_files-2.24.so
7f0b7e12c000-7f0b7e32c000 ---p 0000a000 fe:01 1311265
/lib/x86_64-linux-gnu/libnss_files-2.24.so
7f0b7e32c000-7f0b7e32d000 r--p 0000a000 fe:01 1311265
/lib/x86_64-linux-gnu/libnss_files-2.24.so
7f0b7e32d000-7f0b7e32e000 rw-p 0000b000 fe:01 1311265
/lib/x86_64-linux-gnu/libnss_files-2.24.so
7f0b7e32e000-7f0b7e334000 rw-p 00000000 00:00 0
7f0b7e334000-7f0b7e33f000 r-xp 00000000 fe:01 1311269
/lib/x86_64-linux-gnu/libnss_nis-2.24.so
7f0b7e33f000-7f0b7e53e000 ---p 0000b000 fe:01 1311269
/lib/x86_64-linux-gnu/libnss_nis-2.24.so
7f0b7e53e000-7f0b7e53f000 r--p 0000a000 fe:01 1311269
/lib/x86_64-linux-gnu/libnss_nis-2.24.so
7f0b7e53f000-7f0b7e540000 rw-p 0000b000 fe:01 1311269
/lib/x86_64-linux-gnu/libnss_nis-2.24.so
7f0b7e540000-7f0b7e554000 r-xp 00000000 fe:01 1311178
/lib/x86_64-linux-gnu/libnsl-2.24.so
7f0b7e554000-7f0b7e754000 ---p 00014000 fe:01 1311178
/lib/x86_64-linux-gnu/libnsl-2.24.so
7f0b7e754000-7f0b7e755000 r--p 00014000 fe:01 1311178
/lib/x86_64-linux-gnu/libnsl-2.24.so
7f0b7e755000-7f0b7e756000 rw-p 00015000 fe:01 1311178
/lib/x86_64-linux-gnu/libnsl-2.24.so
7f0b7e756000-7f0b7e758000 rw-p 00000000 00:00 0
7f0b7e758000-7f0b7e75f000 r-xp 00000000 fe:01 1311180
/lib/x86_64-linux-gnu/libnss_compat-2.24.so
7f0b7e75f000-7f0b7e95e000 ---p 00007000 fe:01 1311180
/lib/x86_64-linux-gnu/libnss_compat-2.24.so
7f0b7e95e000-7f0b7e95f000 r--p 00006000 fe:01 1311180
/lib/x86_64-linux-gnu/libnss_compat-2.24.so
7f0b7e95f000-7f0b7e960000 rw-p 00007000 fe:01 1311180
/lib/x86_64-linux-gnu/libnss_compat-2.24.so
7f0b7e960000-7f0b7eaf5000 r-xp 00000000 fe:01 1311151
/lib/x86_64-linux-gnu/libc-2.24.so
7f0b7eaf5000-7f0b7ecf4000 ---p 00195000 fe:01 1311151
/lib/x86_64-linux-gnu/libc-2.24.so
7f0b7ecf4000-7f0b7ecf8000 r--p 00194000 fe:01 1311151
/lib/x86_64-linux-gnu/libc-2.24.so
7f0b7ecf8000-7f0b7ecfa000 rw-p 00198000 fe:01 1311151
/lib/x86_64-linux-gnu/libc-2.24.so
7f0b7ecfa000-7f0b7ecfe000 rw-p 00000000 00:00 0
7f0b7ecfe000-7f0b7ee01000 r-xp 00000000 fe:01 1311172
/lib/x86_64-linux-gnu/libm-2.24.so
7f0b7ee01000-7f0b7f000000 ---p 00103000 fe:01 1311172
/lib/x86_64-linux-gnu/libm-2.24.so
7f0b7f000000-7f0b7f001000 r--p 00102000 fe:01 1311172
/lib/x86_64-linux-gnu/libm-2.24.so
7f0b7f001000-7f0b7f002000 rw-p 00103000 fe:01 1311172
/lib/x86_64-linux-gnu/libm-2.24.so
7f0b7f002000-7f0b7f027000 r-xp 00000000 fe:01 1310814
/lib/x86_64-linux-gnu/libtinfo.so.5.9
7f0b7f027000-7f0b7f227000 ---p 00025000 fe:01 1310814
/lib/x86_64-linux-gnu/libtinfo.so.5.9
7f0b7f227000-7f0b7f22b000 r--p 00025000 fe:01 1310814
/lib/x86_64-linux-gnu/libtinfo.so.5.9
7f0b7f22b000-7f0b7f22c000 rw-p 00029000 fe:01 1310814
/lib/x86_64-linux-gnu/libtinfo.so.5.9
7f0b7f22c000-7f0b7f22f000 r-xp 00000000 fe:01 1311170
/lib/x86_64-linux-gnu/libdl-2.24.so
7f0b7f22f000-7f0b7f42e000 ---p 00003000 fe:01 1311170
/lib/x86_64-linux-gnu/libdl-2.24.so
7f0b7f42e000-7f0b7f42f000 r--p 00002000 fe:01 1311170
/lib/x86_64-linux-gnu/libdl-2.24.so
7f0b7f42f000-7f0b7f430000 rw-p 00003000 fe:01 1311170
/lib/x86_64-linux-gnu/libdl-2.24.so
7f0b7f430000-7f0b7f434000 r-xp 00000000 fe:01 1310846
/lib/x86_64-linux-gnu/libcap.so.2.25
7f0b7f434000-7f0b7f634000 ---p 00004000 fe:01 1310846
/lib/x86_64-linux-gnu/libcap.so.2.25
7f0b7f634000-7f0b7f635000 r--p 00004000 fe:01 1310846
/lib/x86_64-linux-gnu/libcap.so.2.25
7f0b7f635000-7f0b7f636000 rw-p 00005000 fe:01 1310846
/lib/x86_64-linux-gnu/libcap.so.2.25
7f0b7f636000-7f0b7f659000 r-xp 00000000 fe:01 1310733
/lib/x86_64-linux-gnu/ld-2.24.so
7f0b7f6a4000-7f0b7f6c2000 rw-p 00000000 00:00 0
7f0b7f6c2000-7f0b7f713000 r--p 00000000 fe:01 26351510
/usr/lib/locale/aa_DJ.utf8/LC_CTYPE
7f0b7f713000-7f0b7f843000 r--p 00000000 fe:01 26351509
/usr/lib/locale/aa_DJ.utf8/LC_COLLATE
7f0b7f843000-7f0b7f845000 rw-p 00000000 00:00 0
7f0b7f845000-7f0b7f846000 r--p 00000000 fe:01 26351533
/usr/lib/locale/aa_ET/LC_NUMERIC
7f0b7f846000-7f0b7f847000 r--p 00000000 fe:01 26480725
/usr/lib/locale/en_US.utf8/LC_TIME
7f0b7f847000-7f0b7f848000 r--p 00000000 fe:01 26355066
/usr/lib/locale/chr_US/LC_MONETARY
7f0b7f848000-7f0b7f849000 r--p 00000000 fe:01 26355282
/usr/lib/locale/en_AG/LC_MESSAGES/SYS_LC_MESSAGES
7f0b7f849000-7f0b7f84a000 r--p 00000000 fe:01 26355068
/usr/lib/locale/chr_US/LC_PAPER
7f0b7f84a000-7f0b7f84b000 r--p 00000000 fe:01 26355067
/usr/lib/locale/chr_US/LC_NAME
7f0b7f84b000-7f0b7f84c000 r--p 00000000 fe:01 26480723
/usr/lib/locale/en_US.utf8/LC_ADDRESS
7f0b7f84c000-7f0b7f84d000 r--p 00000000 fe:01 26355069
/usr/lib/locale/chr_US/LC_TELEPHONE
7f0b7f84d000-7f0b7f84e000 r--p 00000000 fe:01 26355064
/usr/lib/locale/chr_US/LC_MEASUREMENT
7f0b7f84e000-7f0b7f855000 r--s 00000000 fe:01 25449459
/usr/lib/x86_64-linux-gnu/gconv/gconv-modules.cache
7f0b7f855000-7f0b7f856000 r--p 00000000 fe:01 26480724
/usr/lib/locale/en_US.utf8/LC_IDENTIFICATION
7f0b7f856000-7f0b7f859000 rw-p 00000000 00:00 0
7f0b7f859000-7f0b7f85a000 r--p 00023000 fe:01 1310733
/lib/x86_64-linux-gnu/ld-2.24.so
7f0b7f85a000-7f0b7f85b000 rw-p 00024000 fe:01 1310733
/lib/x86_64-linux-gnu/ld-2.24.so
7f0b7f85b000-7f0b7f85c000 rw-p 00000000 00:00 0
7ffd7905d000-7ffd7907e000 rw-p 00000000 00:00 0 [stack]
7ffd790dc000-7ffd790de000 r--p 00000000 00:00 0 [vvar]
7ffd790de000-7ffd790e0000 r-xp 00000000 00:00 0 [vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0
[vsyscall]
Aborted (core dumped)
Attachment:
xsymlinks
Description: Binary data