Fix yet another sed bug. The s/// command would copy the \ of substitutions before deciding what to do with them (generally overwriting the \ with the new data). When the substitution was A) at the very end of the new string, B) resolved to nothing, it could leave a trailing \ that didn't belong there and didn't get overwritten because the "copy trailing data" part that copies the original string's null terminator already happened before the \ overwrote it. The ghostwheel() function restarts regexes after embedded NUL bytes, but if the string it's passed is _longer_ than the length it's told then it gets confused (and it means we're off the end of our allocation so segfaults are likely). Fix: test for \ first and move the "copy byte" logic into an else case.

/* fsfreeze.c - freeze or thaw filesystem
 *
 * No standard.

USE_FSFREEZE(NEWTOY(fsfreeze, "<1>1f|u|[!fu]", TOYFLAG_USR|TOYFLAG_SBIN))

config FSFREEZE
  bool "fsfreeze"
  default y
  depends on TOYBOX_FIFREEZE
  help
    usage: fsfreeze {-f | -u} MOUNTPOINT

    Freeze or unfreeze a filesystem.

    -f	freeze
    -u	unfreeze
*/

#define FOR_fsfreeze
#include "toys.h"
#include <linux/fs.h>

void fsfreeze_main(void)
{
  int fd = xopen(*toys.optargs, O_RDONLY); 
  long p = 1;

  xioctl(fd, (toys.optflags & FLAG_f) ? FIFREEZE : FITHAW, &p);
  xclose(fd);
}