[PATCH 1/2] ash: setvareq: don't return dangling pointer after unsetting a var

When an existing, non-exported/readonly/strfixed var is unset,
setvareq() frees its "struct var" but then falls through to
"return vp", returning a pointer to memory it just freed.

Checked all callers in ash.c: none currently dereference this
return value on this path, so it's not exploitable today, but it's
a landmine for future callers. Set vp = NULL after freeing it, same
as the "variable never existed" path already returns.

Reported-by: Marcin Nowakowski <[email protected]>
Fixes: https://bugs.busybox.net/show_bug.cgi?id=16108

Signed-off-by: Muhammad Bilal <[email protected]>
---
 shell/ash.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/shell/ash.c b/shell/ash.c
index b8ff67b16..d16ddb374 100644
--- a/shell/ash.c
+++ b/shell/ash.c
@@ -2587,6 +2587,7 @@ setvareq(char *s, int flags)
 		if (((flags & (VEXPORT|VREADONLY|VSTRFIXED|VUNSET)) | (vp->flags & VSTRFIXED)) == VUNSET) {
 			*vpp = vp->next;
 			free(vp);
+			vp = NULL;
  out_free:
 			if ((flags & (VTEXTFIXED|VSTACK|VNOSAVE)) == VNOSAVE)
 				free(s);
-- 
2.55.0