tcsh: fix abort in cleanup_until(), caused by internal xgetpass()

The xgetpass() function pushes a cleanup entry for &osa, but then
attempts to flush the stack until an entry matching &sa.  The two
object pointers do not match, so the stack is popped too much,
and then cleanup_until calls abort() when it unexpectedly hits
the bottom of the cleanup stack.

Reported by:	Paul B. Mahol, onemda at gmail.com,
		Pietro Cerutti, gahr at gahr.ch
PR:		bin/124191
Reviewed by:	mp, kris
MFC after:	2 days

1 files changed, 1 insertions, 1 deletions

diff --git a/contrib/tcsh/tc.func.c b/contrib/tcsh/tc.func.c
index e2db430..f04a5a4 100644
--- a/contrib/tcsh/tc.func.c
+++ b/contrib/tcsh/tc.func.c
@@ -632,7 +632,7 @@ xgetpass(const char *prm)
     }
     strbuf_terminate(&pass);
 
-    cleanup_until(&sa);
+    cleanup_until(&osa);
 
     return pass.s;
 }