Fix yet another sed bug. The s/// command would copy the \ of substitutions before deciding what to do with them (generally overwriting the \ with the new data). When the substitution was A) at the very end of the new string, B) resolved to nothing, it could leave a trailing \ that didn't belong there and didn't get overwritten because the "copy trailing data" part that copies the original string's null terminator already happened before the \ overwrote it. The ghostwheel() function restarts regexes after embedded NUL bytes, but if the string it's passed is _longer_ than the length it's told then it gets confused (and it means we're off the end of our allocation so segfaults are likely). Fix: test for \ first and move the "copy byte" logic into an else case.

// Function to display help text

#include "toys.h"

#if !CFG_TOYBOX_HELP
void show_help(void) {;}
#else
#include "generated/help.h"

#undef NEWTOY
#undef OLDTOY
#define NEWTOY(name,opt,flags) help_##name "\0"
#define OLDTOY(name,oldname,opts,flags) "\xff" #oldname "\0"
static char *help_data =
#include "generated/newtoys.h"
;

void show_help(void)
{
  int i = toys.which-toy_list;
  char *s;

  for (;;) {
    s = help_data;
    while (i--) s += strlen(s) + 1;
    // If it's an alias, restart search for real name
    if (*s != 255) break;
    if (!CFG_TOYBOX) {
      s = xmprintf("See %s --help\n", ++s);

      break;
    }
    i = toy_find(++s)-toy_list;
  }

  fprintf(toys.exithelp ? stderr : stdout, "%s", s);
}
#endif