In subst.c in zsh through 5.4.2, there is a NULL pointer dereference when using ${(PA)…} on an empty array result.
A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Zsh | Zsh | * | 5.4.2 (including) |
| Zsh | Ubuntu | artful | * |
| Zsh | Ubuntu | devel | * |