commit eeae5684793cc532309e9036167d16593a6ee2cf
author Rob Landley <rob@landley.net> Wed Mar 13 09:50:59 2024 -0500
committer Rob Landley <rob@landley.net> Wed Mar 13 09:50:59 2024 -0500
tree 0ea3fffd78e2e08e61f27c09e79e7c7f144b71f9
parent afeed2d46a9a81cbf0ed7e8b13d0a1791907d00a

Fix use after free.

toys/pending/sh.c

diff --git a/toys/pending/sh.c b/toys/pending/sh.c
index 2ca2aa0..4639072 100644
--- a/toys/pending/sh.c
+++ b/toys/pending/sh.c
@@ -3931,8 +3931,9 @@
             printf("\n");
           } else {
             match = atoi(ss);
+            i = *s;
             free(ss);
-            if (!*ss) {
+            if (!i) {
               TT.ff->pl = blk->start;
               continue;
             } else setvarval(blk->fvar, (match<1 || match>blk->farg.c)