Version:4.4 (This isn't so much a security bug) While looking threw copy_cmd.c I saw when allocating new_redirect it doesn't free it when it is done using it.
copy_cmd.c Ln 115 ________________________________________________________________ REDIRECT * copy_redirect (redirect) REDIRECT *redirect; { REDIRECT *new_redirect; new_redirect = (REDIRECT *)xmalloc (sizeof (REDIRECT)); #if 0 FASTCOPY ((char *)redirect, (char *)new_redirect, (sizeof (REDIRECT))); #else *new_redirect = *redirect; /* let the compiler do the fast structure copy */ #endif if (redirect->rflags & REDIR_VARASSIGN) new_redirect->redirector.filename = copy_word (redirect->redirector.filename);