merge segfault fix for [43acb96e678a66ef]: avoid access to freed memo…

…ry in TpoolRelease
tcltk · Feb 24, 2025 · 66aa545 · 66aa545
2 parents 5e8cc6e + b98be3d
commit 66aa545
Showing 1 changed file with 9 additions and 3 deletions.
diff --git a/generic/threadPoolCmd.c b/generic/threadPoolCmd.c
@@ -676,7 +676,9 @@ TpoolCancelObjCmd(
 		    tpoolPtr->workTail = rPtr->prevPtr;
 		}
 		SetResult(NULL, rPtr); /* Just to free the result */
-		Tcl_Free(rPtr->script);
+		if (rPtr->script) {
+		    Tcl_Free(rPtr->script);
+		}
 		Tcl_Free(rPtr);
 		Tcl_ListObjAppendElement(interp, doneList, wObjv[ii]);
 		break;
@@ -1241,6 +1243,7 @@ TpoolWorker(
 	Tcl_MutexUnlock(&tpoolPtr->mutex);
 	TpoolEval(interp, rPtr->script, rPtr->scriptLen, rPtr);
 	Tcl_Free(rPtr->script);
+	rPtr->script = NULL;
 	Tcl_MutexLock(&tpoolPtr->mutex);
 	if (!rPtr->detached) {
 	    int isNew;
@@ -1716,8 +1719,11 @@ TpoolRelease(
      * Cleanup jobs posted but never completed.
      */
 
-    for (rPtr = tpoolPtr->workHead; rPtr; rPtr = rPtr->nextPtr) {
-	Tcl_Free(rPtr->script);
+    for (rPtr = tpoolPtr->workHead; rPtr; rPtr = tpoolPtr->workHead) {
+	tpoolPtr->workHead = rPtr->nextPtr;
+	if (rPtr->script) {
+	    Tcl_Free(rPtr->script);
+	}
 	Tcl_Free(rPtr);
     }
     Tcl_MutexFinalize(&tpoolPtr->mutex);