Fix a gross bug in the ! operator optimization code. The following

kind of expressions caused a dereferencation of an uninitialized malloc
area, yielding wrong expression evaluation at best, and core dumps at
worst (malloc.conf -> AJ):

	find ... ! \( expr1 ! expr2 \) ...

1 files changed, 7 insertions, 1 deletions

diff --git a/usr.bin/find/operator.c b/usr.bin/find/operator.c
index d7c6015..22bfeb6 100644
--- a/usr.bin/find/operator.c
+++ b/usr.bin/find/operator.c
@@ -198,6 +198,12 @@ not_squish(plan)
 				errx(1, "!: no following expression");
 			if (node->type == N_OR)
 				errx(1, "!: nothing between ! and -o");
+			/*
+			 * If we encounter ! ( expr ) then look for nots in
+			 * the expr subplan.
+			 */
+			if (node->type == N_EXPR)
+				node->p_data[0] = not_squish(node->p_data[0]);
 			if (notlevel % 2 != 1)
 				next = node;
 			else
@@ -238,7 +244,7 @@ or_squish(plan)
 		if (next->type == N_EXPR)
 			next->p_data[0] = or_squish(next->p_data[0]);
 
-		/* if we encounter a not then look for not's in the subplan */
+		/* if we encounter a not then look for or's in the subplan */
 		if (next->type == N_NOT)
 			next->p_data[0] = or_squish(next->p_data[0]);