From: Frederic Marchal <fmarchal@users.sourceforge.net>
Date: Mon, 27 Jul 2015 17:53:58 +0000 (+0200)
Subject: Fix a use after free buffer in the regex
X-Git-Url: http://git.ipfire.org/gitweb/gitweb.cgi?a=commitdiff_plain;h=5d6479e9db1624ee871efacecc856cebbc1ccc8a;p=thirdparty%2Fsarg.git

Fix a use after free buffer in the regex

A buffer was used after freeing its memory. As a consequence, replacement
operators were not working in regex.
---

diff --git a/alias.c b/alias.c
index c1e7f0a..089ec21 100644
--- a/alias.c
+++ b/alias.c
@@ -553,9 +553,9 @@ static int Alias_StoreRegexp(struct AliasStruct *AliasData,char *buf)
 	}
 
 	new_alias->Regex.SubPartern=false;
-	for (i=1 ; tmp[i] ; i++)
+	for (i=0 ; Replace[i] ; i++)
 		// both the sed \1 and the perl $1 replacement operators are accepted
-		if ((tmp[i]=='\\' || tmp[i]=='$') && isdigit(tmp[i+1])) {
+		if ((Replace[i]=='\\' || Replace[i]=='$') && isdigit(Replace[i+1])) {
 			new_alias->Regex.SubPartern=true;
 			break;
 		}