Out-of-bounds access in alias command

[Harald van Dijk <harald@xxxxxxxxxxx>]

Hi,

Consider

  alias ""

In aliascmd(), we have

    while ((n = *++argv) != NULL) {
      if ((v = strchr(n+1, '=')) == NULL) { /* n+1: funny ksh stuff */

When *n == '\0', the strchr(n+1, '=') searches past the end of the string.

I have not yet been able to construct a test case where this causes 
problems, because my attempts have resulted in the memory following this 
empty string not containing any = before another null byte appears.

Cheers,
Harald van Dijk