Re: Crash with read-only CDPATH

[Jun T <takimoto-j@xxxxxxxxxxxxxxxxx>]

> 2024/06/30 9:11, Connor Olding <cloningdonor@xxxxxxxxx> wrote:
> 
> This minimal example immediately crashes zsh:
> 
> readonly CDPATH; CDPATH= cd

Thank you for the report.

If CDPATH (a special parameter) is made readonly, save_params()
(called at exec.c:4071) does not allocate any memory for tpm,
but the original pm (obtained by paramtab->getnode() at line 4410)
is added to the restorelist (line 4442).

After addvars() (line 4083) fails ("read-only variable" error),
restore_params() (line 4086) tries to restore CDPATH,
but in this function
  pm (from the restorelist, line 4471), and
  tpm (from paramtab, line 4473)
point to the same memory (the original CDPATH).

Then
    exec.c:4483    tpm->gsu.s->setfn(tpm, pm->u.str)
coredumps when trying to free the memory for pm->u.str.

pm->u.str is the same data as pm->u.data,
and in the case of the original CDPATH it points to the global
variable 'char **cdpath' (line 61) and can't be freed.

I _guess_, in save_param(), we need to add tpm to restorelist
only if a copy of pm (i.e., tpm) is allocated.

Is this reasonable?


diff --git a/Src/exec.c b/Src/exec.c
index e955e85df..ac6c82ec6 100644
--- a/Src/exec.c
+++ b/Src/exec.c
@@ -4408,7 +4408,7 @@ save_params(Estate state, Wordcode pc, LinkList *restore_p, LinkList *remove_p)
     while (wc_code(ac = *pc) == WC_ASSIGN) {
 	s = ecrawstr(state->prog, pc + 1, NULL);
 	if ((pm = (Param) paramtab->getnode(paramtab, s))) {
-	    Param tpm;
+	    Param tpm = NULL;
 	    if (pm->env)
 		delenv(pm);
 	    if (!(pm->node.flags & PM_SPECIAL)) {
@@ -4425,7 +4425,6 @@ save_params(Estate state, Wordcode pc, LinkList *restore_p, LinkList *remove_p)
 		tpm = (Param) zshcalloc(sizeof *tpm);
 		tpm->node.nam = ztrdup(pm->node.nam);
 		copyparam(tpm, pm, 0);
-		pm = tpm;
 	    } else if (!(pm->node.flags & PM_READONLY) &&
 		       (unset(RESTRICTED) || !(pm->node.flags & PM_RESTRICTED))) {
 		/*
@@ -4436,10 +4435,10 @@ save_params(Estate state, Wordcode pc, LinkList *restore_p, LinkList *remove_p)
 		tpm = (Param) hcalloc(sizeof *tpm);
 		tpm->node.nam = pm->node.nam;
 		copyparam(tpm, pm, 1);
-		pm = tpm;
 	    }
 	    addlinknode(*remove_p, dupstring(s));
-	    addlinknode(*restore_p, pm);
+	    if (tpm)
+		addlinknode(*restore_p, tpm);
 	} else
 	    addlinknode(*remove_p, dupstring(s));