From 802a19d93d6b0c9fb1b4ff5a071f4b41c486ea19 Mon Sep 17 00:00:00 2001
From: David Levine <levinedl@acm.org>
Date: Tue, 4 Nov 2014 17:04:30 -0600
Subject: [PATCH] Fixed mlistfree() so that it doesn't dereference a free'd
 list node in order to find the next node.

---
 uip/fmttest.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/uip/fmttest.c b/uip/fmttest.c
index 42060884..a7742bd1 100644
--- a/uip/fmttest.c
+++ b/uip/fmttest.c
@@ -1338,8 +1338,8 @@ mlistfree(void)
 {
     struct mailname *mp, *mp2;
 
-    for (mp = mq.m_next; mp; mp = mp2->m_next) {
-    	mp2 = mp;
+    for (mp = mq.m_next; mp; mp = mp2) {
+	mp2 = mp->m_next;
 	mnfree(mp);
     }
 }
-- 
2.56.0