Revise the order of memory free, so that bugs that attempt to access freed

memory are more likely to segfault and not remain hidden.

1 files changed, 11 insertions, 2 deletions

diff --git a/generic/tclIOUtil.c b/generic/tclIOUtil.c
index 3bdcca3..9a4af9a 100644
--- a/generic/tclIOUtil.c
+++ b/generic/tclIOUtil.c
@@ -480,6 +480,7 @@ FsThrExitProc(
     while (fsRecPtr != NULL) {
 	tmpFsRecPtr = fsRecPtr->nextPtr;
 	if (--fsRecPtr->fileRefCount <= 0) {
+	    fsRecPtr->fsPtr = NULL;
 	    ckfree((char *)fsRecPtr);
 	}
 	fsRecPtr = tmpFsRecPtr;
@@ -588,7 +589,7 @@ static void
 FsRecacheFilesystemList(void)
 {
     ThreadSpecificData *tsdPtr = TCL_TSD_INIT(&tclFsDataKey);
-    FilesystemRecord *fsRecPtr, *tmpFsRecPtr = NULL;
+    FilesystemRecord *fsRecPtr, *tmpFsRecPtr = NULL, *toFree = NULL;
 
     /*
      * Trash the current cache.
@@ -598,7 +599,9 @@ FsRecacheFilesystemList(void)
     while (fsRecPtr != NULL) {
 	tmpFsRecPtr = fsRecPtr->nextPtr;
 	if (--fsRecPtr->fileRefCount <= 0) {
-	    ckfree((char *)fsRecPtr);
+	    fsRecPtr->fsPtr = NULL;
+	    fsRecPtr->nextPtr = toFree;
+	    toFree = fsRecPtr;
 	}
 	fsRecPtr = tmpFsRecPtr;
     }
@@ -634,6 +637,12 @@ FsRecacheFilesystemList(void)
 	fsRecPtr = fsRecPtr->prevPtr;
     }
 
+    while (toFree) {
+	FilesystemRecord *next = toFree->nextPtr;
+	ckfree((char *)toFree);
+	toFree = next;
+    }
+
     /*
      * Make sure the above gets released on thread exit.
      */