From 82e47403c6a8d6fff90f77e9262840050b8e6b2e Mon Sep 17 00:00:00 2001
From: nicm <nicm>
Date: Fri, 31 May 2019 11:34:09 +0000
Subject: [PATCH] Allow % strings that are all numbers or %s, and fix a double
 free. Both reported by George Nachman, GitHub issues 1765 and 1766.

---
 cmd-parse.y | 10 +++++++---
 control.c   |  1 -
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/cmd-parse.y b/cmd-parse.y
index d5d12d95..0a627268 100644
--- a/cmd-parse.y
+++ b/cmd-parse.y
@@ -998,11 +998,15 @@ yylex(void)
 
 		if (ch == '%') {
 			/*
-			 * % is a condition unless it is alone, then it is a
-			 * token.
+			 * % is a condition unless it is all % or all numbers,
+			 * then it is a token.
 			 */
 			yylval.token = yylex_get_word('%');
-			if (strcmp(yylval.token, "%") == 0)
+			for (cp = yylval.token; *cp != '\0'; cp++) {
+				if (*cp != '%' && !isdigit((u_char)*cp))
+					break;
+			}
+			if (*cp == '\0')
 				return (TOKEN);
 			if (strcmp(yylval.token, "%if") == 0) {
 				free(yylval.token);
diff --git a/control.c b/control.c
index b7ac3f62..16fa71bb 100644
--- a/control.c
+++ b/control.c
@@ -91,7 +91,6 @@ control_callback(struct client *c, int closed, __unused void *data)
 		case CMD_PARSE_ERROR:
 			item = cmdq_get_callback(control_error, pr->error);
 			cmdq_append(c, item);
-			free(pr->error);
 			break;
 		case CMD_PARSE_SUCCESS:
 			item = cmdq_get_command(pr->cmdlist, NULL, NULL, 0);