[BUG] segv and random behaviour with $terminfo for TERM=qnx

[Stephane Chazelas <stephane@xxxxxxxxxxxx>]

$ TERM=qnx zsh -c 'echo "${(kv@)terminfo}"'
zsh:1: failed to find end of command substitution
$ TERM=qnx zsh -c 'echo "${terminfo[(r)x]}"'
zsh: segmentation fault  TERM=qnx zsh -c 'echo "${terminfo[(r)x]}"'

Seems to be down to some of the capabilities there having 0xff
bytes. I can reproduce different though still random behaviour
with a simplied entry based on that of qnx:

$ cat a
test,
        kext=\377\270, kf1=\377\201, kf10=\377\212,
        kf11=\377\256, kf12=\377\257, kf13=\377\213,
        kf14=\377\214, kf15=\377\215, kf16=\377\216,
$ TERMINFO=test1 tic a
$ TERMINFO=test1 TERM=test zsh -c 'echo "${terminfo}"'
zsh:1: bad pattern: no no no no no no no no no no no no no no no no no no no no no no no no no no no no no no no no no no no no no no no no no no no no 191 53 \M-^?\M-^A \M-^?) \M-^?\M-8 \M-^?\M-. \M-^?\M-/ \M-^?) \M-^?$ \M-^?= \M-^?|

With current zsh git head built with debug I get:

$ TERM=qnx ./Src/zsh -c 'echo "${terminfo[(r)x]}"'
BUG: substring ends in the middle of a metachar in ztrsub()

Which may give a clue as to what's going on.

Breakpoint 3, ztrsub (t=0x7ffff7fc10e2 "", s=0x7ffff7fc10e2 "") at utils.c:5166
5166                    fprintf(stderr, "BUG: substring ends in the middle of a metachar in ztrsub()\n");
(gdb) bt
#0  ztrsub (t=0x7ffff7fc10e2 "", s=0x7ffff7fc10e2 "") at utils.c:5166
#1  0x000055555560034b in patallocstr (prog=0x7ffff7fbf600, string=0x7ffff7fc10e0 "\377\203", stringlen=2, unmetalen=-1, force=0, patstralloc=0x7fffffffc140) at pattern.c:2149
#2  0x0000555555600711 in pattryrefs (prog=0x7ffff7fbf600, string=0x7ffff7fc10e0 "\377\203", stringlen=2, unmetalenin=-1, patstralloc=0x7fffffffc140, patoffset=0, nump=0x0, begp=0x0,
    endp=0x0) at pattern.c:2323
#3  0x0000555555600568 in pattry (prog=0x7ffff7fbf600, string=0x7ffff7fc10e0 "\377\203") at pattern.c:2225
#4  0x00005555555e1f2b in scanparamvals (hn=0x7ffff7fc0ad0, flags=273) at params.c:652
#5  0x00007ffff7fb496c in scanterminfo (ht=0x55555567dae0, func=0x5555555e1d7c <scanparamvals>, flags=273) at terminfo.c:285
#6  0x00005555555acf12 in scanmatchtable (ht=0x55555567dae0, pprog=0x0, sorted=0, flags1=0, flags2=16777216, scanfunc=0x5555555e1d7c <scanparamvals>, scanflags=273) at hashtable.c:386
#7  0x00005555555ad1e8 in scanhashtable (ht=0x55555567dae0, sorted=0, flags1=0, flags2=16777216, scanfunc=0x5555555e1d7c <scanparamvals>, scanflags=273) at hashtable.c:449
#8  0x00005555555e206f in paramvalarr (ht=0x55555567dae0, flags=273) at params.c:674
#9  0x00005555555e213c in getvaluearr (v=0x7fffffffc810) at params.c:692
#10 0x00005555555e485e in getarg (str=0x7fffffffc618, inv=0x7fffffffc624, v=0x7fffffffc810, a2=0, w=0x7fffffffc610, prevcharlen=0x7fffffffc604, nextcharlen=0x7fffffffc600, flags=256)
    at params.c:1660
#11 0x00005555555e5690 in getindex (pptr=0x7fffffffc6a0, v=0x7fffffffc810, flags=256) at params.c:1970
#12 0x00005555555e5ff2 in fetchvalue (v=0x7fffffffc810, pptr=0x7fffffffc850, bracks=1, flags=256) at params.c:2222
#13 0x000055555561529d in paramsubst (l=0x7ffff7fbf4f0, n=0x7ffff7fbf520, str=0x7fffffffccf0, qt=1, pf_flags=0, ret_flags=0x7fffffffcebc) at subst.c:2743
#14 0x0000555555610455 in stringsubst (list=0x7ffff7fbf4f0, node=0x7ffff7fbf520, pf_flags=0, ret_flags=0x7fffffffcebc, asssub=0) at subst.c:322
#15 0x000055555560f4da in prefork (list=0x7ffff7fbf4f0, flags=0, ret_flags=0x7fffffffcebc) at subst.c:142
#16 0x00005555555977f7 in execcmd_exec (state=0x7fffffffd840, eparams=0x7fffffffd430, input=0, output=0, how=18, last1=1, close_if_forked=-1) at exec.c:3282
#17 0x0000555555594034 in execpline2 (state=0x7fffffffd840, pcode=131, how=18, input=0, output=0, last1=1) at exec.c:2016
#18 0x0000555555592803 in execpline (state=0x7fffffffd840, slcode=4098, how=18, last1=1) at exec.c:1741
#19 0x0000555555591937 in execlist (state=0x7fffffffd840, dont_change_job=0, exiting=1) at exec.c:1495
#20 0x0000555555590fdf in execode (p=0x7ffff7fbf458, dont_change_job=0, exiting=1, context=0x555555634326 "cmdarg") at exec.c:1276
#21 0x0000555555590eb6 in execstring (s=0x7fffffffde09 "TERM=qnx; echo \"${terminfo[(r)x]}\"", dont_change_job=0, exiting=1, context=0x555555634326 "cmdarg") at exec.c:1242
#22 0x00005555555bc793 in init_misc (cmd=0x7fffffffde09 "TERM=qnx; echo \"${terminfo[(r)x]}\"", zsh_name=0x7fffffffde02 "zsh") at init.c:1524
#23 0x00005555555bdfd9 in zsh_main (argc=3, argv=0x7fffffffda58) at init.c:1914
#24 0x000055555556bd39 in main (argc=3, argv=0x7fffffffda58) at ./main.c:93

Cheers,
Stephane