From 1cfb19a85ca9957c5adf89a8392c818abe559dbe Mon Sep 17 00:00:00 2001
From: James Farrell <jamesfarrell@google.com>
Date: Tue, 3 May 2022 18:55:15 +0000
Subject: [PATCH] Fix segfault when trying to unset variable.

Test case: toybox bash -c 'unset FOO'
---
 toys/pending/sh.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/toys/pending/sh.c b/toys/pending/sh.c
index 750cec5c..21fb90a9 100644
--- a/toys/pending/sh.c
+++ b/toys/pending/sh.c
@@ -734,7 +734,7 @@ static int unsetvar(char *name)
 {
   struct sh_fcall *ff;
   struct sh_vars *var = findvar(name, &ff);
-  int ii = var-ff->vars, len = varend(name)-name;
+  int ii = 0, len = varend(name)-name;
 
   if (!var || (var->flags&VAR_WHITEOUT)) return 0;
   if (var->flags&VAR_READONLY) error_msg("readonly %.*s", len, name);
@@ -747,6 +747,7 @@ static int unsetvar(char *name)
     // free from global context
     } else {
       if (!(var->flags&VAR_NOFREE)) free(var->str);
+      ii = var-ff->vars;
       memmove(ff->vars+ii, ff->vars+ii+1, (ff->varslen--)-ii);
     }
     if (!strcmp(name, "IFS"))
-- 
2.39.2