Re: crash with nameref and local argv

[Bart Schaefer <schaefer@xxxxxxxxxxxxxxxx>]

On Tue, Nov 4, 2025 at 1:50 PM Oliver Kiddle <opk@xxxxxxx> wrote:
>
> Adding a check for whether val[4] is NULL or '[' may be enough, or?

There's some other inconsistency in validate_refname() that I have
just noticed.  For example, it begins by rejecting all parameters
beginning with a digit, but then later checks would allow a reference
to the special parameter $0 if things got that far.

> Is there definitely no other variables with similar properties to argv?
> ARGC immediately comes to mind.

Yes, ARGC also needs this treatment, although there are fewer failure
cases because it's read-only.

> Or the various automatically local
> completion/zle widget variables. I've tested those and don't see
> problems.

Because those are all in modules, they can't push themselves onto the
doshfunc() stack like argv/ARGC, they're just in the parameter table
where the whole named reference implementation lives.