From 6589ebf107214a9e6db31764e847301f1adebc81 Mon Sep 17 00:00:00 2001
From: Alex Riesen <raa.lkml@gmail.com>
Date: Sun, 24 May 2009 15:16:49 +0200
Subject: [PATCH] http-push.c::remove_locks(): fix use after free
MIME-Version: 1.0
Content-Type: text/plain; charset=utf8
Content-Transfer-Encoding: 8bit

Noticed and reported by Serhat Şevki Dinçer.

Signed-off-by: Alex Riesen <raa.lkml@gmail.com>
Acked-by: Clemens Buchacher <drizzd@aon.at>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
---
 http-push.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/http-push.c b/http-push.c
index 6805288857..0696da0fec 100644
--- a/http-push.c
+++ b/http-push.c
@@ -1356,8 +1356,9 @@ static void remove_locks(void)
 
 	fprintf(stderr, "Removing remote locks...\n");
 	while (lock) {
+		struct remote_lock *next = lock->next;
 		unlock_remote(lock);
-		lock = lock->next;
+		lock = next;
 	}
 }
 
-- 
2.11.4.GIT