Bug 1389492

Summary: zsh crash in --no-exec and emulation mode if accessing the HOME environment variable
Product: Red Hat Enterprise Linux 7 Reporter: Paulo Andrade <pandrade>
Component: zshAssignee: Kamil Dudka <kdudka>
Status: CLOSED DUPLICATE QA Contact: BaseOS QE - Apps <qe-baseos-apps>
Severity: medium Docs Contact:
Priority: medium    
Version: 7.1CC: kdudka, pandrade
Target Milestone: rc   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: zsh-5.0.2-17.el7 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-10-31 12:35:43 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
zsh-bz1389492.patch none

Description Paulo Andrade 2016-10-27 17:58:23 UTC
Simple reproducer:

"""
$ ln -sf /bin/zsh ksh
$ cat t.sh
# !/bin/sh
echo $HOME
$ ./ksh -n t.sh
"""

  Problem has also been reported to upstream, with
an initial possible patch:

"""
--- zsh-5.0.2/Src/init.c.orig	2016-10-27 15:36:29.210875166 -0200
+++ zsh-5.0.2/Src/init.c	2016-10-27 15:36:33.581867451 -0200
@@ -963,7 +963,7 @@ setupvals(void)
     if (EMULATION(EMULATE_ZSH))
 	ptr = home;
     else
-	ptr = zgetenv("HOME");
+	ptr = home = zgetenv("HOME");
     if (ptr && ispwd(ptr))
 	pwd = ztrdup(ptr);
     else if ((ptr = zgetenv("PWD")) && (strlen(ptr) < PATH_MAX) &&
"""

Comment 2 Paulo Andrade 2016-10-28 11:59:32 UTC
Created attachment 1214975 [details]
zsh-bz1389492.patch

Upstream patch. Needs edit as ChangeLog diff will not apply.

Comment 3 Kamil Dudka 2016-10-30 21:01:49 UTC
Please remember to report the exact NVR (Name-Version-Release) of the package you tested it with.  Is this a duplicate of bug #1267251?

Comment 4 Paulo Andrade 2016-10-31 11:56:45 UTC
It is indeed a duplicate of #1267251
Package was zsh-5.0.2-14.el7_2.2

Comment 5 Kamil Dudka 2016-10-31 12:35:43 UTC

*** This bug has been marked as a duplicate of bug 1267251 ***