Zsh Mailing List Archive
Messages sorted by:
Reverse Date,
Date,
Thread,
Author
PATCH: ksh93: fix use after free of .sh.edchar
- X-seq: zsh-workers 54705
- From: Mikael Magnusson <mikachu@xxxxxxxxx>
- To: zsh-workers@xxxxxxx
- Subject: PATCH: ksh93: fix use after free of .sh.edchar
- Date: Mon, 8 Jun 2026 17:06:45 +0200
- Archived-at: <https://zsh.org/workers/54705>
- List-id: <zsh-workers.zsh.org>
% bindkey T foo
% zle -N foo
% foo() { emulate -L ksh; () { zle -M ${.sh.edchar} } }
% zmodload zsh/ksh93
% [press T twice]
\M-(\M-^Ak\M-<\M-G^?
or alternatively, emulate ksh in the main shell and just define this,
but then you have to make sure you're in a zsh -f shell so random things
aren't entering functions in the background.
% foo() { zle -M ${.sh.edchar} }
the code tries to restore sh_edchar = sh_unsetval; in the else branch,
but this doesn't ever run in the above scenario because we never enter
or leave a function with ksh emulation enabled (or indeed at all).
---
Src/Modules/ksh93.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/Src/Modules/ksh93.c b/Src/Modules/ksh93.c
index 3ab926c5ef..aeba66fc2a 100644
--- a/Src/Modules/ksh93.c
+++ b/Src/Modules/ksh93.c
@@ -197,8 +197,7 @@ ksh93_wrapper(Eprog prog, FuncWrap w, char *name)
strcpy(sh_edmode, "\033");
else
strcpy(sh_edmode, "");
- if (sh_edchar == sh_unsetval)
- sh_edchar = dupstring(getsparam("KEYS"));
+ sh_edchar = dupstring(getsparam("KEYS"));
if (varedarg) {
char *ie = itype_end((sh_name = dupstring(varedarg)), INAMESPC, 0);
if (ie && *ie) {
--
2.38.1
Messages sorted by:
Reverse Date,
Date,
Thread,
Author