Fix a crash found by AFL++

This crash was caused by a value needing to be used after an assignment
to a string, which never needed a value used again before because only
dc did it. So this commit changes it so another string is pushed, if
necessary.

This commit also adds a test for it. It's not an error test; it's just a
normal test added to bc's strings test.

Signed-off-by: Gavin Howard <gavin@yzena.com>

1 files changed, 11 insertions, 0 deletions

diff --git a/src/program.c b/src/program.c
index 351d171f..afc48240 100644
--- a/src/program.c
+++ b/src/program.c
@@ -1300,6 +1300,17 @@ static void bc_program_assign(BcProgram *p, uchar inst) {
 			bc_program_assignStr(p, loc, v, false);
 		}
 
+#if BC_ENABLED
+
+		// If this is true, the value is going to be used again, so we want to
+		// push a temporary with the string.
+		if (inst == BC_INST_ASSIGN) {
+			res.t = BC_RESULT_STR;
+			res.d.loc = loc;
+			bc_vec_push(&p->results, &res);
+		}
+#endif // BC_ENABLED
+
 		// By using bc_program_assignStr(), we short-circuited this, so return.
 		return;
 	}