Fix use after free error spotted by ?ukasz Szpakowski.

diff --git a/toys/posix/tail.c b/toys/posix/tail.c
index e1048be..aba5318 100644 (file)
--- a/toys/posix/tail.c
+++ b/toys/posix/tail.c
@@ -176,9 +176,13 @@ static void do_tail(int fd, char *name)
           linepop = try[count] == '\n';
 
           if (lines > 0) {
+            char c;
+
             do {
+              c = *list->data;
               if (!--(list->len)) free(dlist_pop(&list));
-            } while (*(list->data++) != '\n');
+              else list->data++;
+            } while (c != '\n');
             lines--;
           }
         }