Usischev Yury pointed out a use after free error.

diff --git a/toys/posix/sed.c b/toys/posix/sed.c
index 45816c2..45331ba 100644 (file)
--- a/toys/posix/sed.c
+++ b/toys/posix/sed.c
@@ -635,8 +635,6 @@ writenow:
   if (line && !(toys.optflags & FLAG_n)) emit(line, len, eol);
 
 done:
-  free(line);
-
   if (dlist_terminate(append)) while (append) {
     struct append *a = append->next;
 
@@ -655,6 +653,7 @@ done:
     free(append);
     append = a;
   }
+  free(line);
 }
 
 // Genericish function, can probably get moved to lib.c