• Bug#1105830: /bin/zsh: invalid memory access in wcs_nicechar_sel?

    From Rob Leslie@21:1/5 to All on Thu May 15 21:40:02 2025
    Package: zsh
    Version: 5.9-4+b5
    Severity: normal
    File: /bin/zsh

    Dear Maintainer,

    A zsh process dumped core when the login session was ended (likely due
    to a failed network connection). Here are the relevant logs:

    -----
    May 14 17:56:27 host sshd[1733250]: pam_unix(sshd:session): session closed for user
    May 14 17:56:27 host systemd-logind[566]: Session 18 logged out. Waiting for processes to exit.
    May 14 17:56:27 host kernel: show_signal_msg: 1 callbacks suppressed
    May 14 17:56:27 host kernel: zsh[1733257]: segfault at 0 ip 0000558b81d54b3e sp 00007ffc254531f0 error 6 in zsh[558b81cc8000+9a000] likely on CPU 1 (core 0, socket 1)
    May 14 17:56:27 host kernel: Code: b6 13 48 8d 41 01 48 83 c3 01 83 f2 20 88 51 01 48 8d 48 01 48 39 de 74 1c 0f b6 13 f6 44 57 01 10 75 d9 48 89 c8 48 83 c3 01 <88> 11 48 8d 48 01 48 39 de 75 e4 c6 01 00 48 83 c4 18 4c 89 e0 5b
    May 14 17:56:27 host systemd-coredump[3885063]: Process 1733257 (zsh) of user 1000 dumped core.
    May 14 17:56:27 host systemd-logind[566]: Removed session 18.
    -----

    Here is the relevant coredump info:

    PID: 1733257 (zsh)
    Signal: 11 (SEGV)
    Timestamp: Wed 2025-05-14 17:56:27 PDT
    Command Line: -zsh
    Executable: /usr/bin/zsh
    Control Group: /user.slice/user-1000.slice/session-18.scope
    Unit: session-18.scope
    Slice: user-1000.slice
    Session: 18
    Message: Process 1733257 (zsh) of user 1000 dumped core.

    Stack trace of thread 1733257:
    #0 0x0000558b81d54b3e wcs_nicechar_sel (zsh + 0xa3b3e)
    #1 0x0000558b81d59346 mb_niceformat (zsh + 0xa8346)
    #2 0x0000558b81d59a2d n/a (zsh + 0xa8a2d)
    #3 0x0000558b81d59b5a zerr (zsh + 0xa8b5a)
    #4 0x0000558b81d0bf6d update_job (zsh + 0x5af6d)
    #5 0x0000558b81d442f4 wait_for_processes (zsh + 0x932f4)
    #6 0x0000558b81d43dd5 zhandler (zsh + 0x92dd5)
    #7 0x0000558b81d1bbbe zrealloc (zsh + 0x6abbe)
    #8 0x0000558b81d54a86 wcs_nicechar_sel (zsh + 0xa3a86)
    #9 0x0000558b81d59346 mb_niceformat (zsh + 0xa8346)
    #10 0x0000558b81d59a2d n/a (zsh + 0xa8a2d)
    #11 0x0000558b81d5a05a zwarn (zsh + 0xa905a)
    #12 0x0000558b81cdf47a zexit (zsh + 0x2e47a)
    #13 0x0000558b81d43f89 zhandler (zsh + 0x92f89)
    #14 0x00007f0b419f7050 n/a (libc.so.6 + 0x3c050)
    #15 0x00007f0b419f72d5 __sigsuspend (libc.so.6 + 0x3c2d5)
    #16 0x0000558b81d43367 signal_suspend (zsh + 0x92367)
    #17 0x0000558b81d0c464 n/a (zsh + 0x5b464)
    #18 0x0000558b81d0cc64 waitjobs (zsh + 0x5bc64)
    #19 0x0000558b81cec1e2 n/a (zsh + 0x3b1e2)
    #20 0x0000558b81ced133 execlist (zsh + 0x3c133)
    #21 0x0000558b81d156c4 execif (zsh + 0x646c4)
    #22 0x0000558b81ce9895 n/a (zsh + 0x38895)
    #23 0x0000558b81ceb5ce n/a (zsh + 0x3a5ce)
    #24 0x0000558b81ceb97b n/a (zsh + 0x3a97b)
    #25 0x0000558b81ced133 execlist (zsh + 0x3c133)
    #26 0x0000558b81d15dc7 execcase (zsh + 0x64dc7)
    #27 0x0000558b81ce9895 n/a (zsh + 0x38895)
    #28 0x0000558b81ceb5ce n/a (zsh + 0x3a5ce)
    #29 0x0000558b81ceb97b n/a (zsh + 0x3a97b)
    #30 0x0000558b81ced133 execlist (zsh + 0x3c133)
    #31 0x0000558b81d1579b execif (zsh + 0x6479b)
    #32 0x0000558b81ce9895 n/a (zsh + 0x38895)
    #33 0x0000558b81ceb5ce n/a (zsh + 0x3a5ce)
    #34 0x0000558b81ceb97b n/a (zsh + 0x3a97b)
    #35 0x0000558b81ced133 execlist (zsh + 0x3c133)
    #36 0x0000558b81d1579b execif (zsh + 0x6479b)
    #37 0x0000558b81ce9895 n/a (zsh + 0x38895)
    #38 0x0000558b81ceb5ce n/a (zsh + 0x3a5ce)
    #39 0x0000558b81ceb97b n/a (zsh + 0x3a97b)
    #40 0x0000558b81ced133 execlist (zsh + 0x3c133)
    #41 0x0000558b81ceda02 execode (zsh + 0x3ca02)
    #42 0x0000558b81d03c4a loop (zsh + 0x52c4a)
    #43 0x0000558b81d06569 source (zsh + 0x55569)
    #44 0x0000558b81ccfb31 bin_dot (zsh + 0x1eb31)
    #45 0x0000558b81cd8ed3 execbuiltin (zsh + 0x27ed3)
    #46 0x0000558b81ceaec7 n/a (zsh + 0x39ec7)
    #47 0x0000558b81ceb5ce n/a (zsh + 0x3a5ce)
    #48 0x0000558b81ceb97b n/a (zsh + 0x3a97b)
    #49 0x0000558b81ced61f execlist (zsh + 0x3c61f)
    #50 0x0000558b81ceda02 execode (zsh + 0x3ca02)
    #51 0x0000558b81d03c4a loop (zsh + 0x52c4a)
    #52 0x0000558b81d06569 source (zsh + 0x55569)
    #53 0x0000558b81d06c32 run_init_scripts (zsh + 0x55c32)
    #54 0x0000558b81d07956 zsh_main (zsh + 0x56956)
    #55 0x00007f0b419e224a n/a (libc.so.6 + 0x2724a)
    #56 0x00007f0b419e2305 __libc_start_main (libc.so.6 + 0x27305)
    #57 0x0000558b81cc8d31 _start (zsh + 0x17d31)
    ELF object binary architecture: AMD x86-64

    Kind regards.


    -- Package-specific info:

    Packages which provide vendor completions:

    Desired=Unknown/Install/Remove/Purge/Hold
    | Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend |/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
    ||/ Name Version Architecture Description +++-================-==================-============-=======================================================
    ii curl 7.88.1-10+deb12u12 amd64 command line tool for transferring data with URL syntax
    ii etckeeper 1.18.20-1 all store /etc in git, mercurial, brz or darcs
    ii systemd 252.36-1~deb12u1 amd64 system and service manager ii systemd-coredump 252.36-1~deb12u1 amd64 tools for storing and retrieving coredumps
    ii systemd-resolved 252.36-1~deb12u1 amd64 systemd DNS resolver
    ii udev 252.36-1~deb12u1 amd64 /dev/ and hotplug management daemon

    dpkg-query: no path found matching pattern /usr/share/zsh/vendor-functions/


    -- System Information:
    Debian Release: 12.10
    APT prefers stable-updates
    APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable')
    Architecture: amd64 (x86_64)

    Kernel: Linux 6.1.0-34-amd64 (SMP w/2 CPU threads; PREEMPT)
    Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE not set
    Shell: /bin/sh linked to /usr/bin/dash
    Init: systemd (via /run/systemd/system)
    LSM: AppArmor: enabled

    Versions of packages zsh depends on:
    ii debianutils 5.7-0.5~deb12u1
    ii libc6 2.36-9+deb12u10
    ii libcap2 1:2.66-4
    ii libtinfo6 6.4-4
    ii zsh-common 5.9-4

    Versions of packages zsh recommends:
    ii libc6 2.36-9+deb12u10
    ii libgdbm6 1.23-3
    ii libncursesw6 6.4-4
    ii libpcre3 2:8.39-15

    Versions of packages zsh suggests:
    pn zsh-doc <none>

    -- no debconf information

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Michael Prokop@21:1/5 to All on Sun May 18 20:20:01 2025
    * Rob Leslie [Thu May 15, 2025 at 12:18:22PM -0700]:
    Package: zsh
    Version: 5.9-4+b5
    Severity: normal
    File: /bin/zsh

    Dear Maintainer,

    A zsh process dumped core when the login session was ended (likely due
    to a failed network connection). Here are the relevant logs:

    -----
    May 14 17:56:27 host sshd[1733250]: pam_unix(sshd:session): session closed for user
    May 14 17:56:27 host systemd-logind[566]: Session 18 logged out. Waiting for processes to exit.
    May 14 17:56:27 host kernel: show_signal_msg: 1 callbacks suppressed
    May 14 17:56:27 host kernel: zsh[1733257]: segfault at 0 ip 0000558b81d54b3e sp 00007ffc254531f0 error 6 in zsh[558b81cc8000+9a000] likely on CPU 1 (core 0, socket 1)
    May 14 17:56:27 host kernel: Code: b6 13 48 8d 41 01 48 83 c3 01 83 f2 20 88 51 01 48 8d 48 01 48 39 de 74 1c 0f b6 13 f6 44 57 01 10 75 d9 48 89 c8 48 83 c3 01 <88> 11 48 8d 48 01 48 39 de 75 e4 c6 01 00 48 83 c4 18 4c 89 e0 5b
    May 14 17:56:27 host systemd-coredump[3885063]: Process 1733257 (zsh) of user 1000 dumped core.
    May 14 17:56:27 host systemd-logind[566]: Removed session 18.
    -----

    Here is the relevant coredump info:
    [...]

    Is that reproducible for you somehow?

    FTR, there's zsh 5.9-4+b6 with:

    | * Binary-only non-maintainer upload for amd64; no source changes.
    | * Rebuild for outdated Built-Using (glibc/2.36-9+deb12u5)

    And latest Debian point-release 12.11 provides libc6
    v2.36-9+deb12u10, wondering whether this would change anything,
    assuming that it's even reproducible in some way at all.

    regards
    -mika-

    -----BEGIN PGP SIGNATURE-----

    iQIzBAABCAAdFiEEM8yxNkAa/shDo4djlqh4crfqNzcFAmgqIj4ACgkQlqh4crfq NzeiQxAAsAXdDCyL0zzRR8BA1EtFfqnZMX2sgJkRRhtj6/BGputmJ6MqrOj/Rone SQXQHbSZvmAZXNHAUgQiJsfTKe2l4TkCt9Qz13qNR+Nu6sTl60miVOkIyT3CJJ0f GBIWLEOplpWe3nddlxyDHX9nlI1AhBwQSm+1yUVeGpjsPHRzLl02CJfW86SDA0qM FHT2BPDYhdmAXZBLWrhPKWG8dRPzV1ZoXZh+W0N/HhYFZRHz6OnWHbtrKvPqeE9z 6ctKhC6GTT0pHSvVBzhxW3EQPYaGjXr0L32ZUvqG/PvWUPBUfAgMT4M6q2nMPxV6 lEMGHQ9ObFD3l2xt353/NOwZHnLl7l6SGDHCkRgDDCbu70xtP7cKVB6NjvmR/rOh 4MpUhSjdbV0Z2uK2UR9Watstze9+wd7Kc4vDPPx5/J+3t/Yk5B0Yi99PNadYCuUe EufV/asVCJh+VnKvZ5oHMq3CEiDmzeY4BwDcpMReUnFoXz+AKnCwR+y1LFsSSEDg 7sQlpHFKUBiXutfsg024ilMHDqWYhdfE091Y6zQvdM9YV11YyyOMuVqKcO3O5FHM grd3n5P+/9pmRZv/JcYGUAwZRDTWnUXqINT3FBJQKkzxlyHqrPQ5Gokp4801seQX W18vzFoJgnwlIGsp6Vgo5+/H8mVsfRAJCp4CLFaFuN8nJop/19o=
    =oHam
    -----END PGP SIGNATURE-----

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)