From de36079ccdceffee0ed750ab8780b0c68925ba2f Mon Sep 17 00:00:00 2001
From: Rob Landley <rob@landley.net>
Date: Mon, 27 Oct 2014 19:20:31 -0500
Subject: Fix use after free error spotted by ?ukasz Szpakowski.

---
 toys/posix/tail.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

(limited to 'toys/posix/tail.c')

diff --git a/toys/posix/tail.c b/toys/posix/tail.c
index e1048be7..aba53180 100644
--- a/toys/posix/tail.c
+++ b/toys/posix/tail.c
@@ -176,9 +176,13 @@ static void do_tail(int fd, char *name)
           linepop = try[count] == '\n';
 
           if (lines > 0) {
+            char c;
+
             do {
+              c = *list->data;
               if (!--(list->len)) free(dlist_pop(&list));
-            } while (*(list->data++) != '\n');
+              else list->data++;
+            } while (c != '\n');
             lines--;
           }
         }
-- 
cgit v1.2.3