Allow % strings that are all numbers or %s, and fix a double free. Both

reported by George Nachman, GitHub issues 1765 and 1766.

1 files changed, 7 insertions, 3 deletions

diff --git a/cmd-parse.y b/cmd-parse.y
index d5d12d95..0a627268 100644
--- a/cmd-parse.y
+++ b/cmd-parse.y
@@ -998,11 +998,15 @@ yylex(void)
 
 		if (ch == '%') {
 			/*
-			 * % is a condition unless it is alone, then it is a
-			 * token.
+			 * % is a condition unless it is all % or all numbers,
+			 * then it is a token.
 			 */
 			yylval.token = yylex_get_word('%');
-			if (strcmp(yylval.token, "%") == 0)
+			for (cp = yylval.token; *cp != '\0'; cp++) {
+				if (*cp != '%' && !isdigit((u_char)*cp))
+					break;
+			}
+			if (*cp == '\0')
 				return (TOKEN);
 			if (strcmp(yylval.token, "%if") == 0) {
 				free(yylval.token);