Don't free nacked until we've finished looking at it (an alternative

would be to save nacked->client in a variable).  Do make sure to
remove nacked from the list before calling client_deregister(),
though.

1 files changed, 8 insertions, 4 deletions

diff --git a/server/dispatch.c b/server/dispatch.c
index 5659516..06d9461 100644
--- a/server/dispatch.c
+++ b/server/dispatch.c
@@ -692,15 +692,19 @@ rexmit(arg)
     if (rexmit_times[nacked->rexmits] == -1) {
 	if (!nacked->client
 	    || NOW - nacked->client->last_ack >= CLIENT_GIVEUP_MIN) {
-	    /* The client (if there was one) has been unresponsive.  Give up
-	     * sending this packet, and kill the client if there was one. */
+	    /* The client (if there was one) has been unresponsive.
+	     * Give up sending this packet, and kill the client if
+	     * there was one.  (Make sure to remove nacked from the
+	     * nack list before calling client_deregister(), which
+	     * scans the nack list.)
+	     */
 	    LIST_DELETE(nacked);
-	    free(nacked->packet);
-	    free(nacked);
 	    if (nacked->client) {
 		server_kill_clt(nacked->client);
 		client_deregister(nacked->client, 1);
 	    }
+	    free(nacked->packet);
+	    free(nacked);
 	    return;
 	} else {
 	    /* The client has sent us an ack recently.  Retry with the maximum