49166: fix coredump in ${name:offset:length} with ill-formatted length

zsh-users · Jul 19, 2021 · 9b3a292 · 9b3a292
1 parent 6e10067
commit 9b3a292
Show file tree

Hide file tree

Showing 3 changed files with 15 additions and 9 deletions.
diff --git a/ChangeLog b/ChangeLog
@@ -1,3 +1,8 @@
+2021-07-19  Jun-ichi Takimoto  <takimoto-j@kba.biglobe.ne.jp>
+
+	* 49166: Src/subst.c, Test/D04parameter.ztst: fix coredump in
+	${name:offset:length} with ill-formatted length
+
 2021-07-10  Oliver Kiddle  <opk@zsh.org>
 
 	* 49158: Completion/Debian/Command/_dscverify,

diff --git a/Src/subst.c b/Src/subst.c
@@ -3362,13 +3362,15 @@ paramsubst(LinkList l, LinkNode n, char **str, int qt, int pf_flags,
 		    return NULL;
 		}
 		if (*check_offset2) {
+		    char *nextp;
 		    check_offset = check_colon_subscript(check_offset2 + 1,
-							 &check_offset2);
-		    if (*check_offset2 && *check_offset2 != ':') {
-			zerr("invalid length: %s", check_offset);
-			return NULL;
-		    }
+							 &nextp);
 		    if (check_offset) {
+			check_offset2 = nextp;
+			if (*check_offset2 && *check_offset2 != ':') {
+			    zerr("invalid length: %s", check_offset);
+			    return NULL;
+			}
 			length = mathevali(check_offset);
 			length_set = 1;
 			if (errflag)

diff --git a/Test/D04parameter.ztst b/Test/D04parameter.ztst
@@ -2664,10 +2664,9 @@ F:behavior, see http://austingroupbugs.net/view.php?id=888
 >3: pw
 >4: pw
 
- # Using a subshell because it segfaults.
- ("${: :${{{\"{{lorem ipsum dolor sit amet}}")
--f:regression test for workers/45843#1
-?(eval):1: bad substitution
+ : "${foo:0:${\"}}"
+1:broken length in ${name:offset:length} (workers/45843#1)
+?(eval):1: unrecognized modifier `$'
 
  $ZTST_testdir/../Src/zsh -fc $'$\\\n('
 1:regression test for workers/45843#2: escaped newline in command substitution start token