Fix a race condition: freed storage accessed during a signal handler.

(struct tempnode.next): Now volatile.
(zaptemp): Free the file name after removing it from the temp list,
not before, because a signal can arrive between the two actions
and cleanup () traverses the list.

diff --git a/src/sort.c b/src/sort.c
index affde7b21e687ec85db7df5c051006123130d580..5672b5bbb7a88fdffa984b73089211bf8abd324e 100644 (file)
--- a/src/sort.c
+++ b/src/sort.c
@@ -343,7 +343,7 @@ Set LC_ALL=C to get the traditional sort order that uses native byte values.\n\
 static struct tempnode
 {
   char *name;
-  struct tempnode *next;
+  struct tempnode * volatile next;
 } temphead;
 
 /* Clean up any remaining temporary files. */
@@ -503,8 +503,8 @@ zaptemp (const char *name)
     {
       temp = node->next;
       unlink (temp->name);
-      free (temp->name);
       node->next = temp->next;
+      free (temp->name);
       free ((char *) temp);
     }
 }