From root@rhiannon.scsn.net  Sun Oct 27 21:57:43 1996
Received: from who.cdrom.com (who.cdrom.com [204.216.27.3])
          by freefall.freebsd.org (8.7.5/8.7.3) with ESMTP id VAA01307
          for <FreeBSD-gnats-submit@freebsd.org>; Sun, 27 Oct 1996 21:57:42 -0800 (PST)
Received: from rosie.scsn.net (scsn.net [206.25.246.12])
          by who.cdrom.com (8.7.5/8.6.11) with ESMTP id TAA22998
          for <FreeBSD-gnats-submit@freebsd.org>; Sun, 27 Oct 1996 19:11:34 -0800 (PST)
Received: from rhiannon.scsn.net (cola48.scsn.net [206.25.247.48])
          by rosie.scsn.net (post.office MTA v2.0 0813 ID# 0-13529)
          with ESMTP id AAA132 for <FreeBSD-gnats-submit@freebsd.org>;
          Sun, 27 Oct 1996 22:10:20 -0500
Received: (from root@localhost) by rhiannon.scsn.net (8.8.2/8.6.12) id WAA16917; Sun, 27 Oct 1996 22:11:04 -0500 (EST)
Message-Id: <199610280311.WAA16917@rhiannon.scsn.net>
Date: Sun, 27 Oct 1996 22:11:04 -0500 (EST)
From: dmaddox@scsn.net
Reply-To: dmaddox@scsn.net
To: FreeBSD-gnats-submit@freebsd.org
Subject: 'last' coredumps if MALLOC_OPTIONS include 'J'
X-Send-Pr-Version: 3.2

>Number:         1909
>Category:       bin
>Synopsis:       'last' coredumps if MALLOC_OPTIONS include 'J'
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          closed
>Quarter:
>Keywords:
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sun Oct 27 22:00:02 PST 1996
>Closed-Date:    Mon Oct 28 08:47:43 MET 1996
>Last-Modified:  Mon Oct 28 08:48:12 MET 1996
>Originator:     Donald J. Maddox
>Release:        FreeBSD 2.2-CURRENT i386
>Organization:
None
>Environment:

FreeBSD rhiannon.scsn.net 2.2-CURRENT FreeBSD 2.2-CURRENT #0: Fri Oct 25 23:10:41 EDT 1996     root@rhiannon.scsn.net:/usr/src/sys/compile/RHIANNON  i386

>Description:

'last' coredumps when MALLOC_OPTIONS include 'J'.

The problem seems to be here in /usr/src/usr.bin/last/last.c, lines 192-197:

                        if (bp->ut_line[0] == '~' && !bp->ut_line[1]) {
                                /* everybody just logged out */
                                for (tt = ttylist.lh_first; tt; tt = tt->list.le_next) {
                                        LIST_REMOVE(tt, list);
                                        free(tt);
                                }

The first time this loop iterates, tt is freed; however, when MALLOC_OPTIONS includes
'J', this causes the pointer to be overwritten with junk, so the second iteration
fails.

>How-To-Repeat:

#ln -sf AJ /etc/malloc.conf
#last

>Fix:

I'm not certain what the best fix is, so I'll leave it to the experts... :-)


>Release-Note:
>Audit-Trail:
State-Changed-From-To: open->closed 
State-Changed-By: joerg 
State-Changed-When: Mon Oct 28 08:47:43 MET 1996 
State-Changed-Why:  
Fixed in rev 1.5 of last.c. 

>Unformatted:
