Crash when undoing pasted text when bracketed-paste-magic is enabled

Hello!

I=E2=80=99ve recently received a bug report about zsh crashing on Fedora an=
d I was able
to reduce it to the following reproducer applicable to both 5.9.2 and the l=
atest
master:

Reproducer:

$ cat .zshrc
bindkey "^_" undo
autoload -Uz bracketed-paste-magic
zle -N bracketed-paste bracketed-paste-magic
$ ZDOTDIR=3D$PWD zsh
%=20
// First input some random text, then paste another piece of text using ctr=
l+shift+v,
// then undo that with ctrl+_ couple of times.
zsh: segmentation fault (core dumped)

Backtrace (master on aarch64 Fedora 44, but the bt is the same as on intel)=
:

(gdb) bt
#0  __memcpy_generic () at ../sysdeps/aarch64/multiarch/../memcpy.S:127
#1  0x0000ffff7f5cbb8c in setlastline () at zle_utils.c:1600
#2  0x0000ffff7f5cbce0 in undo (args=3D0xffff7f5f76c0 <zlenoargs>) at zle_u=
tils.c:1635
#3  0x0000ffff7f5a6160 in execzlefunc (func=3D0xffff7f5f41b8 <thingies+4400=
>, args=3D0xffff7f5f76c0 <zlenoargs>, set_bindk=3D0, set_lbindk=3D0)
    at zle_main.c:1488
#4  0x0000ffff7f5a4f04 in zlecore () at zle_main.c:1151
#5  0x0000ffff7f5a5ae0 in zleread (lp=3D0x52fc20 <prompt>, rp=3D0x0, flags=
=3D3, context=3D0, init=3D0xffff7f5d83c0 "zle-line-init",
    finish=3D0xffff7f5d83d0 "zle-line-finish") at zle_main.c:1366
#6  0x0000ffff7f5a8eb4 in zle_main_entry (cmd=3D1, ap=3D...) at zle_main.c:=
2145
#7  0x0000000000464890 in zleentry (cmd=3D1) at init.c:1813
#8  0x0000000000465f5c in inputline () at input.c:421
#9  0x0000000000465d34 in ingetc () at input.c:354
#10 0x00000000004548d8 in ihgetc () at hist.c:420
#11 0x0000000000472f64 in gettok () at lex.c:622
#12 0x00000000004720b0 in zshlex () at lex.c:275
#13 0x00000000004a0dbc in parse_event (endtok=3D37) at parse.c:619
#14 0x000000000045f894 in loop (toplevel=3D1, justonce=3D0) at init.c:167
#15 0x0000000000464dbc in zsh_main (argc=3D1, argv=3D0xffffce54f818) at ini=
t.c:1966
#16 0x000000000040ff48 in main (argc=3D1, argv=3D0xffffce54f818) at ./main.=
c:93
(gdb) up
#1  0x0000ffff7f5cbb8c in setlastline () at zle_utils.c:1600
1600=09    ZS_memcpy(lastline, zleline, (lastll =3D zlell));
(gdb) p linesz
$2 =3D 0

For some reason linesz gets set to zero and glibc=E2=80=99s implementation =
of realloc(ptr, 0)
always returns a NULL pointer which leads to the segmentation fault because=
 lastline is NULL.

Thank you!

Regards,
Lukas