From 2b0d357ce4408ba1b7b5b5a12289ff8d6a240be8 Mon Sep 17 00:00:00 2001
From: joerg <joerg@FreeBSD.org>
Date: Mon, 28 Oct 1996 07:47:34 +0000
Subject: Don't dereference a free()ed pointer.

Closes PR bin/1909: 'last' coredumps if MALLOC_OPTIONS...
---
 usr.bin/last/last.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/usr.bin/last/last.c b/usr.bin/last/last.c
index 89dcef8..25a7627 100644
--- a/usr.bin/last/last.c
+++ b/usr.bin/last/last.c
@@ -162,7 +162,7 @@ void
 wtmp()
 {
 	struct utmp	*bp;			/* current structure */
-	struct ttytab	*tt;				/* ttylist entry */
+	struct ttytab	*tt, *ttx;		/* ttylist entry */
 	struct stat	stb;			/* stat of file for size */
 	long	bl, delta;			/* time difference */
 	int	bytes, wfd;
@@ -191,9 +191,11 @@ wtmp()
 			 */
 			if (bp->ut_line[0] == '~' && !bp->ut_line[1]) {
 				/* everybody just logged out */
-				for (tt = ttylist.lh_first; tt; tt = tt->list.le_next) {
+				for (tt = ttylist.lh_first; tt;) {
 					LIST_REMOVE(tt, list);
-					free(tt);
+					ttx = tt;
+					tt = tt->list.le_next;
+					free(ttx);
 				}
 				currentout = -bp->ut_time;
 				crmsg = strncmp(bp->ut_name, "shutdown",
-- 
cgit v1.1