When the input is comment-only (e.g. "# foo"), tokenize_line() returns
zero tokens; `argv[argc - 1]` then reads `argv[-1]`. Guard the access.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
char *compl =
commands_complete(root, argc, (const char **)argv, all, is_privileged());
- if (compl &&strlen(argv[argc - 1]) < strlen(compl )) {
+ if (compl &&argc > 0 && strlen(argv[argc - 1]) < strlen(compl )) {
if (rl_insert_text(compl +strlen(argv[argc - 1])) < 0) {
free(compl );
goto end;