26686: problem storing long $_ using VARARR()

3 files changed, 27 insertions, 9 deletions

diff --git a/ChangeLog b/ChangeLog
index ef0e3b100..683951eec 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,8 @@
 2009-03-03  Peter Stephenson  <p.w.stephenson@ntlworld.com>
 
+	* 26686: Src/exec.c, Src/utils.c: storing long $_ on the
+	stack can be problematic, so use zalloc() rather than VARARR().
+
 	* 26683: Doc/Zsh/params.yo, Doc/Zsh/roadmap.yo: add some notes
 	on LC_CTYPE etc.
 
@@ -11328,5 +11331,5 @@
 
 *****************************************************
 * This is used by the shell to define $ZSH_PATCHLEVEL
-* $Revision: 1.4599 $                         
+* $Revision: 1.4600 $                         
 *****************************************************
diff --git a/Src/exec.c b/Src/exec.c
index b86e5350c..ed7c08759 100644
--- a/Src/exec.c
+++ b/Src/exec.c
@@ -4431,10 +4431,12 @@ doshfunc(Shfunc shfunc, LinkList doshargs, int noreturnval)
 mod_export void
 runshfunc(Eprog prog, FuncWrap wrap, char *name)
 {
-    int cont;
-    VARARR(char, ou, underscoreused);
+    int cont, ouu;
+    char *ou;
 
-    memcpy(ou, underscore, underscoreused);
+    ou = zalloc(ouu = underscoreused);
+    if (ou)
+	memcpy(ou, underscore, underscoreused);
 
     while (wrap) {
 	wrap->module->wrapper++;
@@ -4445,13 +4447,19 @@ runshfunc(Eprog prog, FuncWrap wrap, char *name)
 	    (wrap->module->node.flags & MOD_UNLOAD))
 	    unload_module(wrap->module);
 
-	if (!cont)
+	if (!cont) {
+	    if (ou)
+		zfree(ou, ouu);
 	    return;
+	}
 	wrap = wrap->next;
     }
     startparamscope();
     execode(prog, 1, 0);
-    setunderscore(ou);
+    if (ou) {
+	setunderscore(ou);
+	zfree(ou, ouu);
+    }
     endparamscope();
 }
 
diff --git a/Src/utils.c b/Src/utils.c
index fbe1eb223..7a983d48d 100644
--- a/Src/utils.c
+++ b/Src/utils.c
@@ -1340,9 +1340,13 @@ checkmailpath(char **s)
 		    fprintf(shout, "You have new mail.\n");
 		    fflush(shout);
 		} else {
-		    VARARR(char, usav, underscoreused);
+		    char *usav;
+		    int uusav = underscoreused;
 
-		    memcpy(usav, underscore, underscoreused);
+		    usav = zalloc(underscoreused);
+
+		    if (usav)
+			memcpy(usav, underscore, underscoreused);
 
 		    setunderscore(*s);
 
@@ -1353,7 +1357,10 @@ checkmailpath(char **s)
 			fputc('\n', shout);
 			fflush(shout);
 		    }
-		    setunderscore(usav);
+		    if (usav) {
+			setunderscore(usav);
+			zfree(usav, uusav);
+		    }
 		}
 	    }
 	    if (isset(MAILWARNING) && st.st_atime > st.st_mtime &&