From: Jim Meyering <jim@meyering.net>
Date: Mon, 19 Feb 2001 08:52:53 +0000 (+0000)
Subject: Fix a race condition: freed storage accessed during a signal handler.
X-Git-Tag: TEXTUTILS-2_0_12~57
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=5af9b0048f103248f4973b8362e83f04ce524201;p=thirdparty%2Fcoreutils.git

Fix a race condition: freed storage accessed during a signal handler.

(struct tempnode.next): Now volatile.
(zaptemp): Free the file name after removing it from the temp list,
not before, because a signal can arrive between the two actions
and cleanup () traverses the list.
---

diff --git a/src/sort.c b/src/sort.c
index affde7b21e..5672b5bbb7 100644
--- a/src/sort.c
+++ b/src/sort.c
@@ -343,7 +343,7 @@ Set LC_ALL=C to get the traditional sort order that uses native byte values.\n\
 static struct tempnode
 {
   char *name;
-  struct tempnode *next;
+  struct tempnode * volatile next;
 } temphead;
 
 /* Clean up any remaining temporary files. */
@@ -503,8 +503,8 @@ zaptemp (const char *name)
     {
       temp = node->next;
       unlink (temp->name);
-      free (temp->name);
       node->next = temp->next;
+      free (temp->name);
       free ((char *) temp);
     }
 }