A fix from Larry Doolittle for some nasty segfaults when sh.c tried to free a

corrupted cmd pointer, and where it would truncate a command line at the first
double space.
 -Erik

3 files changed, 9 insertions, 9 deletions

diff --git a/lash.c b/lash.c
index d321c929b..67d6e4f51 100644
--- a/lash.c
+++ b/lash.c
@@ -970,10 +970,10 @@ static int expand_arguments(char *command)
         {
         
                 int flags = GLOB_NOCHECK|GLOB_BRACE|GLOB_TILDE;
-                char * tmpcmd;
+                char * tmpcmd, *cmd, *cmd_copy;
                 /* We need a clean copy, so strsep can mess up the copy while
                  * we write stuff into the original (in a minute) */
-                char * cmd = strdup(command);
+                cmd = cmd_copy = strdup(command);
                 *command = '\0';
                 for (tmpcmd = cmd; (tmpcmd = strsep(&cmd, " \t")) != NULL;) {
                         if (*tmpcmd == '\0')
@@ -1006,7 +1006,7 @@ static int expand_arguments(char *command)
                                 globfree (&expand_result);
                         }
                 }
-                free(cmd);
+                free(cmd_copy);
                 trim(command);
         }
         
diff --git a/sh.c b/sh.c
index d321c929b..67d6e4f51 100644
--- a/sh.c
+++ b/sh.c
@@ -970,10 +970,10 @@ static int expand_arguments(char *command)
         {
         
                 int flags = GLOB_NOCHECK|GLOB_BRACE|GLOB_TILDE;
-                char * tmpcmd;
+                char * tmpcmd, *cmd, *cmd_copy;
                 /* We need a clean copy, so strsep can mess up the copy while
                  * we write stuff into the original (in a minute) */
-                char * cmd = strdup(command);
+                cmd = cmd_copy = strdup(command);
                 *command = '\0';
                 for (tmpcmd = cmd; (tmpcmd = strsep(&cmd, " \t")) != NULL;) {
                         if (*tmpcmd == '\0')
@@ -1006,7 +1006,7 @@ static int expand_arguments(char *command)
                                 globfree (&expand_result);
                         }
                 }
-                free(cmd);
+                free(cmd_copy);
                 trim(command);
         }
         
diff --git a/shell/lash.c b/shell/lash.c
index d321c929b..67d6e4f51 100644
--- a/shell/lash.c
+++ b/shell/lash.c
@@ -970,10 +970,10 @@ static int expand_arguments(char *command)
         {
         
                 int flags = GLOB_NOCHECK|GLOB_BRACE|GLOB_TILDE;
-                char * tmpcmd;
+                char * tmpcmd, *cmd, *cmd_copy;
                 /* We need a clean copy, so strsep can mess up the copy while
                  * we write stuff into the original (in a minute) */
-                char * cmd = strdup(command);
+                cmd = cmd_copy = strdup(command);
                 *command = '\0';
                 for (tmpcmd = cmd; (tmpcmd = strsep(&cmd, " \t")) != NULL;) {
                         if (*tmpcmd == '\0')
@@ -1006,7 +1006,7 @@ static int expand_arguments(char *command)
                                 globfree (&expand_result);
                         }
                 }
-                free(cmd);
+                free(cmd_copy);
                 trim(command);
         }