Re: #7 (typeset -Tp) (was Re: Zsh - Multiple DoS Vulnerabilities)

[Peter Stephenson <p.stephenson@xxxxxxxxxxx>]

On Sat, 2019-05-11 at 03:45 +0200, Oliver Kiddle wrote:
> I'm fairly certain that the second part of the patch renders the lines
> removed in the first part as dead code but it'd be good if someone else
> could check my logic which is as follows: Given -p, typeset_single() is
> only now called when -m is set. usepm will always then be true because
> with -m, pm will always be set and never with PM_UNSET. So we go into
> the if (usepm) block on line 2193 which has early returns on every
> branch.

That certainly looks plausible but you could always put a DPUTS() check
there.

pws