mirror of
git://git.code.sf.net/p/cdesktopenv/code
synced 2025-03-09 15:50:02 +00:00
cda8fc916f
Reproducer: $ set -o histexpand $ echo foo !#^:h !#^:& /usr/local/bin/ksh: :&: no previous substitution ksh(80822,0x10bc2a5c0) malloc: *** error for object 0x10a13bae3: pointer being freed was not allocated ksh(80822,0x10bc2a5c0) malloc: *** set a breakpoint in malloc_error_break to debug Abort Analysis: In hist_expand(), the 'cc' variable has two functions: it holds a pointer to a malloc'ed copy of the current line, and is also used as a temporary pointer with functions like strchr(). After that temporary use, it is set to NULL again, because the 'done:' routine checks if it non-NULL to decide whether to free the pointer. But if an error occurs, the function may jump straight to 'done' without first setting cc to NULL if it had been used as a temporary pointer. It then tries to free an unallocated pointer. src/cmd/ksh93/edit/hexpand.c: hist_expand(): - Eliminate this bad practice by using a separate variable for temporary pointer purposes. (I was unable to reproduce the crash in a pty regression test, though it is consistently reproducible in a real interactive session. So I haven't added that test.) |
||
|---|---|---|
| .. | ||
| builtin | ||
| INIT | ||
| ksh93 | ||
| Mamfile | ||