Fix read-after-free in VG_(HT_destruct). This fixes

memcheck/tests/mempools.  Thanks to Jeroen Witmond for tracking it
down.

git-svn-id: svn://svn.valgrind.org/valgrind/trunk@5429

diff --git a/coregrind/m_hashtable.c b/coregrind/m_hashtable.c
index 98d041355b773973434a1233aecd6b522563491c..eec3c319c6043718e7ea782e8c2b96af727c9d52 100644 (file)
--- a/coregrind/m_hashtable.c
+++ b/coregrind/m_hashtable.c
@@ -234,11 +234,12 @@ void* VG_(HT_Next)(VgHashTable table)
 
 void VG_(HT_destruct)(VgHashTable table)
 {
-   UInt      i;
-   VgHashNode* node;
+   UInt       i;
+   VgHashNode *node, *node_next;
    
    for (i = 0; i < table->n_chains; i++) {
-      for (node = table->chains[i]; node != NULL; node = node->next) {
+      for (node = table->chains[i]; node != NULL; node = node_next) {
+         node_next = node->next;
          VG_(free)(node);
       }
    }

diff --git a/docs/internals/3_1_BUGSTATUS.txt b/docs/internals/3_1_BUGSTATUS.txt
index 37a61f5afeaf031cbbc451b33d86eca93fae4455..fe654e9ae481611faab66b41a5f7a1fdee5a8ae4 100644 (file)
--- a/docs/internals/3_1_BUGSTATUS.txt
+++ b/docs/internals/3_1_BUGSTATUS.txt
@@ -23,7 +23,7 @@ pending   pending   118239   amd64: 0xF 0xAE 0x3F (clflush)
 pending   pending   118274   amd64: 0xDD #7 (fnsave)
 pending   pending   118466   add %r,%r mishandled by memcheck
 pending   pending   n-i-bz   VALGRIND_COUNT_LEAKS arg types (Olly Betts)
-pending   pending   n-i-bz   memcheck/tests/mempool reads freed memory
+v5429     pending   n-i-bz   memcheck/tests/mempool reads freed memory
 v5366/67/70 pending n-i-bz   AshleyP's custom-allocator assertion
 vx1501    pending   n-i-bz   Dirk strict-aliasing stuff
 v5368     pending   n-i-bz   More space for debugger cmd line (Dan Thaler)