[PATCH 2/2] ash: rmaliases: don't dereference stale pointer after freealias()

freealias() returns the same pointer unchanged if the alias is
still ALIASINUSE (not freed), or a different pointer if it freed
it. So "ap == *app" is only true when 'ap' was not freed, and
dereferencing ap->next there is safe at runtime - but 'ap' was
passed to a function that can free it, so it reads as tainted to
static analysis (Coverity CID 5896585).

Dereference via *app instead, which is freshly re-read and
provably live. No functional change: in the taken branch,
*app == ap by construction.

Reported-by: Marcin Nowakowski <[email protected]>
Fixes: https://bugs.busybox.net/show_bug.cgi?id=16105

Signed-off-by: Muhammad Bilal <[email protected]>
---
 shell/ash.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/shell/ash.c b/shell/ash.c
index d16ddb374..2a7f7443e 100644
--- a/shell/ash.c
+++ b/shell/ash.c
@@ -3556,7 +3556,7 @@ rmaliases(void)
 		for (ap = *app; ap; ap = *app) {
 			*app = freealias(*app);
 			if (ap == *app) {
-				app = &ap->next;
+				app = &(*app)->next;
 			}
 		}
 	}
-- 
2.55.0