MAINTAINERS: bug-gnu-utils@prep.ai.mit.edu
SUBJECT: Bug in GNU dc 1.04 (with patch)

Consider the input "Ia"; this pushes the input radix onto the stack
and then pops it off.  The pop function ("a") causes a duplicate
free() -- dc_num2int() is given a flag to free the number, but the
number is then (incorrectly) passed to dc_free_num().  The solution
was simply to comment out that call to dc_free_num().

The input "Ia" is insufficient to cause a core dump on my system
(despite the duplicate free()), but the input file dc.badinput.s-max
will if you do this:

	dc dc.badinput.s-max

That file is available at this URL:

	http://home.pacbell.net/s-max/scott/dc.badinput.s-max