From eeae5684793cc532309e9036167d16593a6ee2cf Mon Sep 17 00:00:00 2001
From: Rob Landley <rob@landley.net>
Date: Wed, 13 Mar 2024 09:50:59 -0500
Subject: [PATCH] Fix use after free.

---
 toys/pending/sh.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/toys/pending/sh.c b/toys/pending/sh.c
index 2ca2aa01..46390724 100644
--- a/toys/pending/sh.c
+++ b/toys/pending/sh.c
@@ -3931,8 +3931,9 @@ do_then:
             printf("\n");
           } else {
             match = atoi(ss);
+            i = *s;
             free(ss);
-            if (!*ss) {
+            if (!i) {
               TT.ff->pl = blk->start;
               continue;
             } else setvarval(blk->fvar, (match<1 || match>blk->farg.c)
-- 
2.39.2