In subst.c in zsh through 5.4.2, there is a NULL pointer dereference when using ${(PA)…} on an empty array result.
The product dereferences a pointer that it expects to be valid but is NULL.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Zsh | Zsh | * | 5.4.2 (including) |
| Zsh | Ubuntu | artful | * |
| Zsh | Ubuntu | devel | * |