Re: Bug: Null byte in shell history causes segfault during $historywords reverse subscripting

[Jun T <takimoto-j@xxxxxxxxxxxxxxxxx>]

> 2023/05/27 4:37, Eric Freese <ericdfreese@xxxxxxxxx> wrote:
> 
> I've come across a segfault when shell history has been loaded from a
> file and contains a command where a null byte was entered into the
> line editor via ^V^@ (opposed to typing as $'\0'). Reverse
> subscripting $historywords on a pattern that does not match triggers
> the error.

Is this enough?


diff --git a/Src/hist.c b/Src/hist.c
index 7e6394406..e2b4b0b22 100644
--- a/Src/hist.c
+++ b/Src/hist.c
@@ -3796,8 +3796,14 @@ histsplitwords(char *lineptr, short **wordsp, int *nwordsp, int *nwordposp,
 			zrealloc(words, nwords*sizeof(*words));
 		}
 		words[nwordpos++] = lineptr - start;
-		while (*lineptr && !inblank(*lineptr))
-		    lineptr++;
+		while (*lineptr) {
+		    if (*lineptr == Meta && lineptr[1])
+			lineptr += 2;
+		    else if (!inblank(*lineptr))
+			lineptr++;
+		    else
+			break;
+		}
 		words[nwordpos++] = lineptr - start;
 	    }
 	} while (*lineptr);