Version:4.4
(This isn't so much a security bug)
While looking threw copy_cmd.c I saw when allocating new_redirect it doesn't free it when it is done using it.
copy_cmd.c
Ln 115
________________________________________________________________
REDIRECT *
copy_redirect (redirect)
REDIRECT *redirect;
{
REDIRECT *new_redirect;
new_redirect = (REDIRECT *)xmalloc (sizeof (REDIRECT));
#if 0
FASTCOPY ((char *)redirect, (char *)new_redirect, (sizeof (REDIRECT)));
#else
*new_redirect = *redirect; /* let the compiler do the fast structure copy */
#endif
if (redirect->rflags & REDIR_VARASSIGN)
new_redirect->redirector.filename = copy_word (redirect->redirector.filename);