bc: hopefully fix bug 14956 (use-after-free)

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>

1 files changed, 2 insertions, 0 deletions

diff --git a/miscutils/bc.c b/miscutils/bc.c
index ab785bbc8..1300a63fb 100644
--- a/miscutils/bc.c
+++ b/miscutils/bc.c
@@ -2892,6 +2892,8 @@ static char peek_inbuf(void)
 	) {
 		xc_read_line(&G.input_buffer, G.prs.lex_input_fp);
 		G.prs.lex_inbuf = G.input_buffer.v;
+		// lex_next_at may point to now-freed data, update it:
+		G.prs.lex_next_at = G.prs.lex_inbuf;
 		if (G.input_buffer.len <= 1) // on EOF, len is 1 (NUL byte)
 			G.prs.lex_input_fp = NULL;
 	}