From owner-freebsd-bugs  Sun Oct 27 22:00:05 1996
Return-Path: owner-bugs
Received: (from root@localhost)
          by freefall.freebsd.org (8.7.5/8.7.3) id WAA02023
          for bugs-outgoing; Sun, 27 Oct 1996 22:00:05 -0800 (PST)
Received: (from gnats@localhost)
          by freefall.freebsd.org (8.7.5/8.7.3) id WAA02007;
          Sun, 27 Oct 1996 22:00:03 -0800 (PST)
Resent-Date: Sun, 27 Oct 1996 22:00:03 -0800 (PST)
Resent-Message-Id: <199610280600.WAA02007@freefall.freebsd.org>
Resent-From: gnats (GNATS Management)
Resent-To: freebsd-bugs
Resent-Reply-To: FreeBSD-gnats@freefall.FreeBSD.org, dmaddox@scsn.net
Received: from who.cdrom.com (who.cdrom.com [204.216.27.3])
          by freefall.freebsd.org (8.7.5/8.7.3) with ESMTP id VAA01307
          for <FreeBSD-gnats-submit@freebsd.org>; Sun, 27 Oct 1996 21:57:42 -0800 (PST)
Received: from rosie.scsn.net (scsn.net [206.25.246.12])
          by who.cdrom.com (8.7.5/8.6.11) with ESMTP id TAA22998
          for <FreeBSD-gnats-submit@freebsd.org>; Sun, 27 Oct 1996 19:11:34 -0800 (PST)
Received: from rhiannon.scsn.net (cola48.scsn.net [206.25.247.48])
          by rosie.scsn.net (post.office MTA v2.0 0813 ID# 0-13529)
          with ESMTP id AAA132 for <FreeBSD-gnats-submit@freebsd.org>;
          Sun, 27 Oct 1996 22:10:20 -0500
Received: (from root@localhost) by rhiannon.scsn.net (8.8.2/8.6.12) id WAA16917; Sun, 27 Oct 1996 22:11:04 -0500 (EST)
Message-Id: <199610280311.WAA16917@rhiannon.scsn.net>
Date: Sun, 27 Oct 1996 22:11:04 -0500 (EST)
From: dmaddox@scsn.net
Reply-To: dmaddox@scsn.net
To: FreeBSD-gnats-submit@freebsd.org
X-Send-Pr-Version: 3.2
Subject: bin/1909: 'last' coredumps if MALLOC_OPTIONS include 'J'
Sender: owner-bugs@freebsd.org
X-Loop: FreeBSD.org
Precedence: bulk


>Number:         1909
>Category:       bin
>Synopsis:       'last' coredumps if MALLOC_OPTIONS include 'J'
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sun Oct 27 22:00:02 PST 1996
>Last-Modified:
>Originator:     Donald J. Maddox
>Organization:
None
>Release:        FreeBSD 2.2-CURRENT i386
>Environment:

FreeBSD rhiannon.scsn.net 2.2-CURRENT FreeBSD 2.2-CURRENT #0: Fri Oct 25 23:10:41 EDT 1996     root@rhiannon.scsn.net:/usr/src/sys/compile/RHIANNON  i386

>Description:

'last' coredumps when MALLOC_OPTIONS include 'J'.

The problem seems to be here in /usr/src/usr.bin/last/last.c, lines 192-197:

                        if (bp->ut_line[0] == '~' && !bp->ut_line[1]) {
                                /* everybody just logged out */
                                for (tt = ttylist.lh_first; tt; tt = tt->list.le_next) {
                                        LIST_REMOVE(tt, list);
                                        free(tt);
                                }

The first time this loop iterates, tt is freed; however, when MALLOC_OPTIONS includes
'J', this causes the pointer to be overwritten with junk, so the second iteration
fails.

>How-To-Repeat:

#ln -sf AJ /etc/malloc.conf
#last

>Fix:

I'm not certain what the best fix is, so I'll leave it to the experts... :-)


>Audit-Trail:
>Unformatted: