Memory error on exporting XPC_SERVICE_NAME from a subshell

["Varun Gandhi" <varun@xxxxxxxxx>]

Hey folks,

While bisecting my shell configuration for an unrelated issue, I ran into what looks like a use-after-free on exporting XPC_SERVICE_NAME from a subshell. Minimized example shown below:

❯ env -i -S'XPC_SERVICE_NAME=0' zsh --no-rcs

Varuns-MacBook-Pro% export

HOME=/Users/varun

LOGNAME=varun

OLDPWD=/Users/varun

PWD=/Users/varun

SHLVL=1

XPC_SERVICE_NAME=0

Varuns-MacBook-Pro% (export XPC_SERVICE_NAME=0)

zsh(29836,0x104d1c580) malloc: *** error for object 0x14c9043d0: pointer being freed was not allocated

zsh(29836,0x104d1c580) malloc: *** set a breakpoint in malloc_error_break to debug

zsh: abort      ( export XPC_SERVICE_NAME=0 ; )

Configuration information:

- zsh 5.8.1 (x86_64-apple-darwin21.0) (from /bin/zsh). This bug doesn't seem arch-specific, but I'll note that the x86_64 in the version is misleading, the binary is a universal one (arm64e + x86_64).

- macOS 12.4 (21F79) running on an M1 Mac.

Let me know if you're having trouble reproducing the issue.

Cheers,

Varun