From: David Levine <levinedl@acm.org>
Date: Tue, 4 Nov 2014 23:04:30 +0000 (-0600)
Subject: Fixed mlistfree() so that it doesn't dereference a free'd list node
X-Git-Url: https://diplodocus.org/git/nmh/commitdiff_plain/802a19d93d6b0c9fb1b4ff5a071f4b41c486ea19?hp=ff5eb06992e08944273e1299e0af7bd8cb1ad568

Fixed mlistfree() so that it doesn't dereference a free'd list node
in order to find the next node.
---

diff --git a/uip/fmttest.c b/uip/fmttest.c
index 42060884..a7742bd1 100644
--- a/uip/fmttest.c
+++ b/uip/fmttest.c
@@ -1338,8 +1338,8 @@ mlistfree(void)
 {
     struct mailname *mp, *mp2;
 
-    for (mp = mq.m_next; mp; mp = mp2->m_next) {
-    	mp2 = mp;
+    for (mp = mq.m_next; mp; mp = mp2) {
+	mp2 = mp->m_next;
 	mnfree(mp);
     }
 }