From d6c692599f0838e9d6fe240ba958a7205042191b Mon Sep 17 00:00:00 2001
From: Clint Adams <clint@users.sourceforge.net>
Date: Tue, 14 Oct 2008 23:41:13 +0000
Subject: 25898: avoid dereference of p after it is freed in getmathfunc.

---
 Src/module.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

(limited to 'Src/module.c')

diff --git a/Src/module.c b/Src/module.c
index d507d8202..8e5586e6d 100644
--- a/Src/module.c
+++ b/Src/module.c
@@ -1266,10 +1266,11 @@ getmathfunc(const char *name, int autol)
 	if (!strcmp(name, p->name)) {
 	    if (autol && p->module && !(p->flags & MFF_USERFUNC)) {
 		char *n = dupstring(p->module);
+		int flags = p->flags;
 
 		removemathfunc(q, p);
 
-		(void)ensurefeature(n, "f:", (p->flags & MFF_AUTOALL) ? NULL :
+		(void)ensurefeature(n, "f:", (flags & MFF_AUTOALL) ? NULL :
 				    name);
 
 		return getmathfunc(name, 0);
-- 
cgit 1.4.1