3364777 Stop segfault caused by reading from struct after it had been freed.

2 files changed, 9 insertions, 1 deletions

diff --git a/ChangeLog b/ChangeLog
index d7eb0e4..0cfdfef 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2011-07-12  Don Porter  <dgp@users.sourceforge.net>
+
+	* generic/tclUnixSock.c:  [Bug 3364777] Stop segfault caused by
+	reading from struct after it had been freed. 
+
 2011-07-11  Joe Mistachkin  <joe@mistachkin.com>
 
 	* generic/tclExecute.c: [Bug 3339502]: Correct cast for CURR_DEPTH to
diff --git a/unix/tclUnixSock.c b/unix/tclUnixSock.c
index 52b089c..f302b70 100644
--- a/unix/tclUnixSock.c
+++ b/unix/tclUnixSock.c
@@ -544,8 +544,11 @@ TcpCloseProc(
 	}
     
     }
-    for (fds = statePtr->fds.next; fds != NULL; fds = fds->next) {
+    fds = statePtr->fds.next;
+    while (fds != NULL) {
+	TcpFdList *next = fds->next;
         ckfree(fds);
+	fds = next;
     }
     if (statePtr->addrlist != NULL) {
         freeaddrinfo(statePtr->addrlist);