Path: utzoo!attcan!utgpu!jarvis.csri.toronto.edu!cs.utexas.edu!usc!snorkelwacker!mit-eddie!uw-beaver!cornell!ken
From: ken@gvax.cs.cornell.edu (Ken Birman)
Newsgroups: comp.sys.isis
Subject: Minor bug fix in cmd.c
Message-ID: <35004@cornell.UUCP>
Date: 8 Dec 89 16:47:16 GMT
Sender: nobody@cornell.UUCP
Reply-To: ken@cs.cornell.edu (Ken Birman)
Distribution: comp
Organization: Cornell Univ. CS Dept, Ithaca NY
Lines: 18

Thanks to Mark Laubach at HP Labs for pinning down the following
problem.  In cmd.c, free is bring called from the "list" command
with a bad pointer (a pointer is allocated and then gets incremented
prior to calling free).

Here's the patch to cmd.c:
453c453
<     gl_desc  *glp;
---
>     gl_desc  *glp, *tlp;
472c472
<     glp = pg_list(arg);
---
>     tlp = glp = pg_list(arg);
490c490
<     free((char *)glp);
---
>     free((char *)tlp);