[PATCH] Fix miscounting of redirection pairs in ash that could cause a crash.

[Chris Metcalf]

Since the node pointer being used to check for NTO2 entries isn't the one
that's actually walking the list, we can end up undercounting.  Then when
we populate the array, we can walk off the end of allocated memory.

Signed-off-by: Chris Metcalf <cmetcalf at tilera.com>
---
 shell/ash.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/shell/ash.c b/shell/ash.c
index 8d7c4ca..2c1779f 100644
--- a/shell/ash.c
+++ b/shell/ash.c
@@ -5111,7 +5111,7 @@ redirect(union node *redir, int flags)
 		do {
 			sv_pos++;
 #if ENABLE_ASH_BASH_COMPAT
-			if (redir->nfile.type == NTO2)
+			if (tmp->nfile.type == NTO2)
 				sv_pos++;
 #endif
 			tmp = tmp->nfile.next;
-- 
1.6.5.2