When running shell scripts, the process coredump.

[TangJia0726]

the test shell scripts are shown as blew：

#!/bin/bash
db_dir="./"
db_file="$db_dir/test.db"
if [ ! -f "$db_file" ]; then
    echo "$db_file" ""  
fi
tables="val1 val2 val3 val4 val5 val6 val7"
for table in $tables; do
    echo "$db_file" "test $table 11111"
    if [ $? -eq 0 ];
    then
        # Step 3: Create table if it does not exist
        case $table in
            "val1")
                echo "$db_file" " \
                    TEST TEST \
                        TEST TEST \
                        TEST TEST \
                        TEST TEST \
                        TEST TEST \
                        TEST TEST \
                        TEST TEST \
                        TEST TEST \
                    TEST "
                echo "$db_file" " \
                    TEST TEST \
                        TEST TEST \
                        TEST TEST \
                        BEGIN \
                        TEST "
                ;;
            "val2")
                echo "$db_file" " \
                    TEST \
                        TEST \
                    TEST "
                echo "$db_file" "TEST"
                echo "$db_file" " \
                    TEST \
                        TEST \
                        TEST \
                        TEST \
                            TEST \
                            TEST \
                            TEST \
                        TEST"
                ;;
            "val3")
                echo "$db_file" " \
                    TEST \
                        TEST \
                        TEST \
                        TEST \
                        TEST \
                    TEST"
                echo "$db_file" " \
                    TEST \
                        TEST "
                ;;
            "val4")
                echo "$db_file" " \
                    TEST \
                        TEST \
                    TEST "
                echo "$db_file" " \
                    TEST \
                        TEST \
                        TEST"
                ;;
            "val5")
                echo "$db_file" " \
                    TEST \
                        TEST \
                    TEST"
                echo "$db_file" " \
                    TEST \
                        TEST \
                        TEST"
                ;;
            "val6")
                echo "$db_file" " \
                    TEST \
                    TEST "
                echo "$db_file" " \
                    TEST
                        TEST
                        TEST " \
                ;;
            "val7")
                echo "$db_file" " \
                    TEST \
                        TEST \
                        TEST \
                    TEST"
                ;;
        esac
    fi
done

Maybe this is a problem about freeing an incorrect address.

        } else if (!strcmp(s, "case")) {
          if (!(TT.ff->blk->fvar = expand_one_arg(ss, NO_NULL))) break;
          if (ss != TT.ff->blk->fvar)
            push_arg(&TT.ff->blk->fdelete, TT.ff->blk->fvar);
        }

In the run_lines function, if the case feature is encountered, TT.ff->blk->fvar will be put into the link list TT.ff->blk->fdelete. When the case is over, the pop_block function is called to free the link list data.

However, the data stored in TT.ff->blk->fvar is not a correct address (it's an address returned by getvar function plusing offset). So toybox crashed in free stage.