[BUG] heap-buffer-overflow setinputstring() src/input.c

Hello Dash maintainers,

I encountered a bug in Dash in commit fd725b7a75 and would like to 
report it. The details are provided below.
The target crashed when reading from memory after it has been freed.
==131==ERROR: AddressSanitizer: heap-buffer-overflow on address 
0x5020000004f5 at pc 0x60bd0214d131 bp 0x7fff45c03700 sp 0x7fff45c02eb0
READ of size 2 at 0x5020000004f5 thread T0
     #0 0x60bd0214d130 in __interceptor_strlen 
../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:389
     #1 0x60bd02239fee in setinputstring /upstream/dash/src/input.c:593
     #2 0x60bd0226936c in expandstr /upstream/dash/src/parser.c:1739
     #3 0x60bd02215e18 in evalcommand /upstream/dash/src/eval.c:881
     #4 0x60bd0220d9f0 in evaltree /upstream/dash/src/eval.c:305
     #5 0x60bd0224b2eb in cmdloop /upstream/dash/src/main.c:246
     #6 0x60bd0212643c in main /upstream/dash/src/main.c:180

0x5020000004f5 is located 0 bytes to the right of 5-byte region 
[0x5020000004f0,0x5020000004f5)
allocated by thread T0 here:
     #0 0x60bd021bb38f in __interceptor_malloc 
../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
     #1 0x60bd0224c728 in ckmalloc /upstream/dash/src/memalloc.c:66

SUMMARY: AddressSanitizer: heap-buffer-overflow 
../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:389 
in __interceptor_strlen

Environment:
Debian-12, x86-64
afl-clang-lto compiler AFL++ project

Steps to reproduce:

export CC=afl-clang-lto
export AFL_USE_ASAN=1
./autogen.sh
./configure
make
cd src
./debian -i crash.txt

Steps to generate crash.txt:
copy the text into file bs64.txt
=====================================================================================
UFM0PSdcXFxcXFxcXFxcXFxcXFxcXFwgIiR7dp5yLSQqXApwcmludCAvdGhVCm1jLlxcXFxcXFxc
K1skTElORU5gXSAnCnRyYXAgJ2VjaG8gdHJhcDogJExJTkVOTycgRVJSCgpzZXQgLXgKCiNpcyCA
AG4jIG1kLWEKYjp4CmI6eQpyXSBbamMgMC9hCmNkICRFTVBkIC4uCmxpICMgb3JpZ5Jic3BlYyAw
L2EKY2QgB0VNUGQgLi709PT09PT0AAD//1M9Ll1uIGFuIGV4aXQjICAgVGhpcyBwcm9ncmFtIGlz
IGZyZWUgc29mdHdhcmU6IHlvdSBjYW4gcmVkaXN0cmlidXRlIGl0IGFuZC9vciBtb2RpZnkKIyAg
IGl0IHVuZGVyIHRoZSB0ZXJtcyBvZiB0aGUgR05VIEdlbmVyYWwgUHVibGljIExpY2Vuc2UgYXMg
cHVibGlzaGVkIGJ5CiMgICB0aGUgRnJlZSBTb2Z0d2FyZSBGb3VuZGF0aW9uLCBlaXRoZXIgdmVy
c2lvbiAzIG9mIHRoZSBMaWNlbnNlLCBvcgojICAgKGYKIyAgIE1FUkNIQU5UQUJJTElUWSBvciBG
IyBvcGlnaW5hbGx5IGZyb20gTWlrZSBIYWVydGVsCmZvbygpIHsgY2FzZSAkMSBpbiBhKikgOzsg
KikgOzsgZXNhYyA7fQpiYXIoKSB7IGNhc2UgJDUgaW4gW2FiY10qKSA7OyAqKTs7IGVzYWMgO30K
YmF6KCkgeyBjYXNlICQxIGluIHh5enp5KSA7OyAqKSA7OyBlc2FjIDt9CmZ+RH4jICAgVGhpcyBw
cm9ncmFtIGlzIGZyZWUgc29mdHdhcmU6IHlvdSBjYW4gcmVkaXN0cmlidXRlIGl0IGFuZC9vciBt
b2RpZnkKIyAgIGl0IHVuZGVyIHRoZSB0ZXJtcyBvZiB0aGUgR05VIEdlbmVyYWwgUHVibGljIExp
Y2Vuc2UgYXMgcHVibGlzaGVkIGJ5CiMgICB0aGUgRnJlZSBTb2Z0d2FyZSBGb3VuZGF0aW9uLCBl
aXRoZXIgdmVyc2lvbiAzIG9mIHRoZSBMaWNlbnNlLCBvcgojICAgKGF0IHlvdXIgb3B0aW9uKSBh
bnkgbGF0ZXIgdmVyc2lvbi4KIwojICAgVGhpcyBwcm9ncmFtIGlzIGRpc3RyaWJ1dGVkIGluIHRo
ZSBob3BlIHRoYXQgaXQgd2lsbCBiZSB1c2VmdWwsCiMgICBidXQgV0lUSE9VVCBBTlkgV0FSUkFO
VFk7IHdpdGhvdXQgZXZlbiB0aGUgaW1wbGllZCB3YXJyYW50eSBvZgojICAgTUVSQ0hBTlRBQklM
SVRZIG9yIEZJVE5FU1MgRk9SIEEgUEFSVElDVUxBUiBQVVJQT1NFLiAgU2VlIHRoZQojICAgR05V
IEdlbmVyYWwgUHVibGljIExpY2Vuc2UgZm9yIG1vcmUgZGV0YWlscy4KIwojICAgWW91IHNob3Vs
ZCBoYXZlIHJlY2VpdmVkIGEgY29weSBvZiB0aGUgR05VIEdlbmVyYWwgUHVibGljIExpY2Vuc2UK
IyAgIGFsb25nIHdpdGggdGhpcyBwcm9ncmFtLiAgSWYgbm90LCBzZWUgPGh0dHA6Ly93d3cuZ251
Lm9yZy9saWNlbnNlcy8+LgojCmRlY2xhcmUgLW50IHI9YQoKZigpCnsKCWRlY2xhcmUgYQoJZGVj
bGFyZSAtbiByPWEKCWRlY2xhcmUgLXAgYSByCn0KCmYKdW5zZXQgUFM0PScrWyRMSU5FPCRoZWxs
bywId29ybGNobyB0cmFwOiAkTElORU5PJyBFUlIKCnNldCAteAoKIyAgbSBpcyBmcmVlIHNvZnR3
YXJlOiB5b3UgY2FuIHJlZGlzdHJpYnV0ZSBpdCBhbmQvb3IgbW9kaWZ5CiMgICBpdCB1bmRlciB0
aGUgdGVybXMgb2YgdGhlIEdOVSBHZW5lcmFsIFB1YmxpYyBMaWNlbnNlIGFzIHB1Ymxpc2hlZCBi
eQojICAgdGhlIEZyZWUgU29mdHdhcmUgRm91bmRhdGlvbiwgZWl0aGVyIHZlcnNpb24gMzZvZiB0
aGUgTGljZW5zZSwgb3IKIyAgIChhdCB5b3VyIG9wdGlvbikgYW55IGxhdGVyIHZlcnNpb24uCiMK
IyAgIFRoaXMgcHJvZ3JhbSBpcyBkaXN0cmlidXRlZCBpbiB0aGUgaG9wZSB0aGF0IGl0IHdpbGwg
YmUgdXNlZnVsLAojICAgYnV0IFdJVEhPVVQgQU5ZIFdBUlJBTlRZOyB3aXRob3V0IGV2ZW4gdGhl
IGltcGxpZWQgd2FycmFudHkgb2YKIyAgIE1FUkNIQU5UQUJJTElUWSBvciBGSVRORVNTIEZPUiBB
IFBBUlRJQ1VMQVIgUFVSUE9TRS4gIFNlZSB0aGUKIyAgIEdOVSBHZW5lcmFsICNhJCgxIC90aFUK
dWMuMgpwcmludGYgIiUjKi4qZiMgbWFrZSBzdXJlIGFsaWFzZXMgdGhhdCBlbmQgaW4gbXVsdGli
eXRlIGNoYXJhY3RlcnMgZG9uJ3QgaW50ZnJmZXJlIHdpdGggdDBcMmhlCiMgc3BhY2Ugc2VudCMg
ICBUaGlzIHByb2dyYW0gaXMgZnJlZSBzb2Z0d2FyZTogeW91IGNhbiByZWRpc3RyaWJ1dGUgaXQg
YW5kL29yIG1vZGlmeQojICAgaXQgdW5kZXIgdGhlIHRlcm1zIG9mIHRoZSBHTlUgR2VuZXJhbCBQ
dWJsaWMgTGljZW5zZSBhcyBwdWJsaXNoZWQgYnkKIyAgIHRoZSBGcmVlIFNvZnR3YXJlIEZvdW5k
YXRpb24sIGVpdGhlciB2ZXJzaW9uIDMgb2YgdGhlIExpY2Vuc2UsIG9yCiMgICAoYXQgeW91ciBv
cHRpb24pIGFueSBsYXRlciB2ZXJzaW9uLgojCiMgICBUaGlzIHByb2dyYW0gaXMgZGlzdHJpYnV0
ZWQgaW4gdGhlIGhvcGUgdGhhdCBpdCB3aWxsIGJlIHVzZWZ1bCwKIyAgIGJ1dCBXSVRIT1VUIEFO
WSBXQVJSQU5UWTsgd2l0aG91dCBldmVuIHRoZSBpbXBsaWVkIHdhcnJhbnR5IG9mCiMgICBNRVJD
SEFOVEFCSUxJVFkgb3IgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UuICBTZWUgdGhl
CiMgICBHTlUgR2VuZXJhbCBQdWJsaWMgTGljZW5zZSBmb3IgbW9yZQpaSUZTPSQnXG4nJCdcdCck
JyAnIGRldGFpbHMuCiMKIyAgIFlvdSBzaG91bGQgaGF2ZSByZWNlaXZlZCBhIGNvcHkgb2YgdGhl
IEdOVSBHZW5lcmFsIFB1YmxpYyBMaWNl
======================================================================================
Then do the action:
base64 -d bs64.txt > crash.txt