Revise the order of memory free, so that bugs that attempt to access freed memory

are more likely to segfault and not remain hidden.

1 files changed, 11 insertions, 2 deletions

diff --git a/generic/tclIOUtil.c b/generic/tclIOUtil.c
index f466ca8..577af87 100644
--- a/generic/tclIOUtil.c
+++ b/generic/tclIOUtil.c
@@ -420,6 +420,7 @@ FsThrExitProc(
     while (fsRecPtr != NULL) {
 	tmpFsRecPtr = fsRecPtr->nextPtr;
 	if (--fsRecPtr->fileRefCount <= 0) {
+	    fsRecPtr->fsPtr = NULL;
 	    ckfree(fsRecPtr);
 	}
 	fsRecPtr = tmpFsRecPtr;
@@ -528,7 +529,7 @@ static void
 FsRecacheFilesystemList(void)
 {
     ThreadSpecificData *tsdPtr = TCL_TSD_INIT(&tclFsDataKey);
-    FilesystemRecord *fsRecPtr, *tmpFsRecPtr = NULL;
+    FilesystemRecord *fsRecPtr, *tmpFsRecPtr = NULL, *toFree = NULL;
 
     /*
      * Trash the current cache.
@@ -538,7 +539,9 @@ FsRecacheFilesystemList(void)
     while (fsRecPtr != NULL) {
 	tmpFsRecPtr = fsRecPtr->nextPtr;
 	if (--fsRecPtr->fileRefCount <= 0) {
-	    ckfree(fsRecPtr);
+	    fsRecPtr->fsPtr = NULL;
+	    fsRecPtr->nextPtr = toFree;
+	    toFree = fsRecPtr;
 	}
 	fsRecPtr = tmpFsRecPtr;
     }
@@ -574,6 +577,12 @@ FsRecacheFilesystemList(void)
 	fsRecPtr = fsRecPtr->prevPtr;
     }
 
+    while (toFree) {
+	FilesystemRecord *next = toFree->nextPtr;
+	ckfree(toFree);
+	toFree = next;
+    }
+
     /*
      * Make sure the above gets released on thread exit.
      */