Fix a use after free buffer in the regex

A buffer was used after freeing its memory. As a consequence, replacement
operators were not working in regex.

diff --git a/alias.c b/alias.c
index c1e7f0af8d7a7a406371037d534a50ce3c97e965..089ec21d0e289c1cb0317491d261c39b5d4e9185 100644 (file)
--- a/alias.c
+++ b/alias.c
@@ -553,9 +553,9 @@ static int Alias_StoreRegexp(struct AliasStruct *AliasData,char *buf)
        }
 
        new_alias->Regex.SubPartern=false;
-       for (i=1 ; tmp[i] ; i++)
+       for (i=0 ; Replace[i] ; i++)
                // both the sed \1 and the perl $1 replacement operators are accepted
-               if ((tmp[i]=='\\' || tmp[i]=='$') && isdigit(tmp[i+1])) {
+               if ((Replace[i]=='\\' || Replace[i]=='$') && isdigit(Replace[i+1])) {
                        new_alias->Regex.SubPartern=true;
                        break;
                }