Multiple Null Pointer Dereference Vulnerabilities in Zsh identified by Static Analysis
Pasidu Rashmitha <[email protected]>
| Newsgroups | gmane.comp.shells.zsh.devel |
|---|---|
| Message-ID | <CABJ0pR+AHmVUQZb2hzWdwgKzs3EN57mD6GCbepfmtWrAvhGrVw@mail.gmail.com> |
Dear Zsh Maintainers,
Following up on my previous report, I would like to bring to your attention
a significant number of Null Pointer Dereference issues discovered during
my static analysis of the Zsh source code using scan-build.
Summary of Findings:
Issue Count: Approximately 51 Null Pointer Dereference instances.
Tool Used: Clang Static Analyzer.
Potential Impact: These vulnerabilities could lead to unexpected
crashes (Segmentation Faults) and Denial of Service (DoS) if triggered by
specific inputs or environment configurations.
Key Locations (Partial List):
Many of these issues are located in the Src/Zle/ and core shell logic,
where pointers are dereferenced without prior null checks.
I have attached a summary screenshot of the analysis report showing the
scale of these issues. I am ready to provide the detailed HTML reports for
each specific case to assist with the patching process.
Best regards,
Pasidu (Security Researcher)
Screenshot_2026-05-03_19_07_01.png
(image/png, 188.4 KB) - not displayed
Screenshot_2026-05-03_19_07_16.png
(image/png, 186.1 KB) - not displayed
Screenshot_2026-05-03_19_07_51.png
(image/png, 122.9 KB) - not displayed