From b155e612fc364939c343724a7fe64e1815023c1f Mon Sep 17 00:00:00 2001 From: christos Date: Sat, 6 Nov 2010 20:40:12 +0000 Subject: [PATCH] PR/44052: Takahiro HAYASHI: chrooted ntpd refers freed memory As mentioned in the pr, process_routing_msgs can delete the current reader, so cache the next element before calling it. --- external/bsd/ntp/dist/ntpd/ntp_io.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/external/bsd/ntp/dist/ntpd/ntp_io.c b/external/bsd/ntp/dist/ntpd/ntp_io.c index 95c10942fc6b..3a80dafa28cf 100644 --- a/external/bsd/ntp/dist/ntpd/ntp_io.c +++ b/external/bsd/ntp/dist/ntpd/ntp_io.c @@ -1,4 +1,4 @@ -/* $NetBSD: ntp_io.c,v 1.2 2009/12/14 00:43:58 christos Exp $ */ +/* $NetBSD: ntp_io.c,v 1.3 2010/11/06 20:40:12 christos Exp $ */ /* * ntp_io.c - input/output routines for ntpd. The socket-opening code @@ -3355,11 +3355,14 @@ input_handler( asyncio_reader = asyncio_reader_list; while (asyncio_reader != NULL) { + struct asyncio_reader *next = asyncio_reader->link; + if (FD_ISSET(asyncio_reader->fd, &fds)) { ++select_count; (asyncio_reader->receiver)(asyncio_reader); } - asyncio_reader = asyncio_reader->link; + + asyncio_reader = next; } #endif /* HAS_ROUTING_SOCKET */