A fix from Larry Doolittle for some nasty segfaults when sh.c tried to free a

corrupted cmd pointer, and where it would truncate a command line at the first
double space.
 -Erik

3 files changed, 9 insertions, 9 deletions

diff --git a/lash.c b/lash.c
index d321c929b..67d6e4f51 100644
--- a/lash.c
+++ b/lash.c
@@ -970,10 +970,10 @@ static int expand_arguments(char *command)
 	{
         
 		int flags = GLOB_NOCHECK|GLOB_BRACE|GLOB_TILDE;
-		char * tmpcmd;
+		char * tmpcmd, *cmd, *cmd_copy;
 		/* We need a clean copy, so strsep can mess up the copy while
 		 * we write stuff into the original (in a minute) */
-		char * cmd = strdup(command);
+		cmd = cmd_copy = strdup(command);
 		*command = '\0';
 		for (tmpcmd = cmd; (tmpcmd = strsep(&cmd, " \t")) != NULL;) {
 			if (*tmpcmd == '\0')
@@ -1006,7 +1006,7 @@ static int expand_arguments(char *command)
 				globfree (&expand_result);
 			}
 		}
-		free(cmd);
+		free(cmd_copy);
 		trim(command);
 	}
 	
diff --git a/sh.c b/sh.c
index d321c929b..67d6e4f51 100644
--- a/sh.c
+++ b/sh.c
@@ -970,10 +970,10 @@ static int expand_arguments(char *command)
 	{
         
 		int flags = GLOB_NOCHECK|GLOB_BRACE|GLOB_TILDE;
-		char * tmpcmd;
+		char * tmpcmd, *cmd, *cmd_copy;
 		/* We need a clean copy, so strsep can mess up the copy while
 		 * we write stuff into the original (in a minute) */
-		char * cmd = strdup(command);
+		cmd = cmd_copy = strdup(command);
 		*command = '\0';
 		for (tmpcmd = cmd; (tmpcmd = strsep(&cmd, " \t")) != NULL;) {
 			if (*tmpcmd == '\0')
@@ -1006,7 +1006,7 @@ static int expand_arguments(char *command)
 				globfree (&expand_result);
 			}
 		}
-		free(cmd);
+		free(cmd_copy);
 		trim(command);
 	}
 	
diff --git a/shell/lash.c b/shell/lash.c
index d321c929b..67d6e4f51 100644
--- a/shell/lash.c
+++ b/shell/lash.c
@@ -970,10 +970,10 @@ static int expand_arguments(char *command)
 	{
         
 		int flags = GLOB_NOCHECK|GLOB_BRACE|GLOB_TILDE;
-		char * tmpcmd;
+		char * tmpcmd, *cmd, *cmd_copy;
 		/* We need a clean copy, so strsep can mess up the copy while
 		 * we write stuff into the original (in a minute) */
-		char * cmd = strdup(command);
+		cmd = cmd_copy = strdup(command);
 		*command = '\0';
 		for (tmpcmd = cmd; (tmpcmd = strsep(&cmd, " \t")) != NULL;) {
 			if (*tmpcmd == '\0')
@@ -1006,7 +1006,7 @@ static int expand_arguments(char *command)
 				globfree (&expand_result);
 			}
 		}
-		free(cmd);
+		free(cmd_copy);
 		trim(command);
 	}