--- /dev/null
+--- a/shell/ash.c
++++ b/shell/ash.c
+@@ -5424,7 +5424,11 @@ rmescapes(char *str, int flag)
+ size_t fulllen = len + strlen(p) + 1;
+
+ if (flag & RMESCAPE_GROW) {
++ int strloc = str - (char *)stackblock();
+ r = makestrspace(fulllen, expdest);
++ /* p and str may be invalidated by makestrspace */
++ str = (char *)stackblock() + strloc;
++ p = str + len;
+ } else if (flag & RMESCAPE_HEAP) {
+ r = ckmalloc(fulllen);
+ } else {