merge segfault fix for [43acb96e678a66ef]: avoid access to freed memo…

…ry in TpoolRelease
tcltk · Feb 24, 2025 · b98be3d · b98be3d
2 parents 9be1c4b + e48a9c4
commit b98be3d
Showing 1 changed file with 9 additions and 3 deletions.
diff --git a/generic/threadPoolCmd.c b/generic/threadPoolCmd.c
@@ -674,7 +674,9 @@ TpoolCancelObjCmd(
 		    tpoolPtr->workTail = rPtr->prevPtr;
 		}
 		SetResult(NULL, rPtr); /* Just to free the result */
-		ckfree(rPtr->script);
+		if (rPtr->script) {
+		    ckfree(rPtr->script);
+		}
 		ckfree((char *)rPtr);
 		Tcl_ListObjAppendElement(interp, doneList, wObjv[ii]);
 		break;
@@ -1239,6 +1241,7 @@ TpoolWorker(
 	Tcl_MutexUnlock(&tpoolPtr->mutex);
 	TpoolEval(interp, rPtr->script, rPtr->scriptLen, rPtr);
 	ckfree(rPtr->script);
+	rPtr->script = NULL;
 	Tcl_MutexLock(&tpoolPtr->mutex);
 	if (!rPtr->detached) {
 	    int isNew;
@@ -1715,8 +1718,11 @@ TpoolRelease(
      * Cleanup jobs posted but never completed.
      */
 
-    for (rPtr = tpoolPtr->workHead; rPtr; rPtr = rPtr->nextPtr) {
-	ckfree(rPtr->script);
+    for (rPtr = tpoolPtr->workHead; rPtr; rPtr = tpoolPtr->workHead) {
+	tpoolPtr->workHead = rPtr->nextPtr;
+	if (rPtr->script) {
+	    ckfree(rPtr->script);
+	}
 	ckfree((char *)rPtr);
     }
     Tcl_MutexFinalize(&tpoolPtr->mutex);