bc: hopefully fix bug 14956 (use-after-free)

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>

1 files changed, 2 insertions, 0 deletions

diff --git a/miscutils/bc.c b/miscutils/bc.c
index ab785bbc8..1300a63fb 100644
--- a/miscutils/bc.c
+++ b/miscutils/bc.c
@@ -2892,6 +2892,8 @@ static char peek_inbuf(void)
         ) {
                 xc_read_line(&G.input_buffer, G.prs.lex_input_fp);
                 G.prs.lex_inbuf = G.input_buffer.v;
+                // lex_next_at may point to now-freed data, update it:
+                G.prs.lex_next_at = G.prs.lex_inbuf;
                 if (G.input_buffer.len <= 1) // on EOF, len is 1 (NUL byte)
                         G.prs.lex_input_fp = NULL;
         }