From 10614e04929a6d109a5e90524e446b637aaf0c13 Mon Sep 17 00:00:00 2001
From: Richard Qin <richard.qin.x@gmail.com>
Date: Sat, 3 Jan 2026 02:13:08 +0800
Subject: Fix: critical malloc size calculation bug

Summary:
- Fixed an integer arithmetic error in malloc() where 'nunits' was initialized to 0, causing incorrect heap sizing.
- This bug caused malloc to return pointers pointing to unmapped memory pages, leading to Store Page Fault (scause 15) at process boundaries.
- Switched memory allocator logic to use byte-based size calculation instead of K&R style units to prevent off-by-one errors.

Improvements:
- Shell now starts successfully without segfaults.
---
 src/user/sh.cc | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

(limited to 'src/user/sh.cc')

diff --git a/src/user/sh.cc b/src/user/sh.cc
index 287d2be..1f2e950 100644
--- a/src/user/sh.cc
+++ b/src/user/sh.cc
@@ -383,12 +383,21 @@ int main()
 
     while (getcmd(buf, sizeof(buf)) >= 0)
     {
-        if (buf[0] == 'c' && buf[1] == 'd' && buf[2] == ' ')
+        if (buf[0] == 'c' && buf[1] == 'd' && (buf[2] == ' ' || buf[2] == '\n' || buf[2] == 0))
         {
-            buf[strlen(buf) - 1] = 0; // chop \n
-            if (chdir(buf + 3) < 0)
+            if (buf[strlen(buf) - 1] == '\n')
+                buf[strlen(buf) - 1] = 0;
+
+            char *path = buf + 3;
+            if (buf[2] == '\n' || buf[2] == 0)
+            {
+                printf("cd: argument missing\n");
+                continue;
+            }
+
+            if (chdir(path) < 0)
             {
-                printf("cannot cd %s\n", buf + 3);
+                printf("cannot cd %s\n", path);
             }
             continue;
         }
-- 
cgit v1.2.3