From f1bf7e6f5619bb423440ff530c4d0f8a200d8aeb Mon Sep 17 00:00:00 2001
From: shinomori <shinomori@54d463be-8e91-2dee-dedb-b68131a5f0ec>
Date: Sun, 27 Mar 2005 13:41:03 +0000
Subject: do not access freed memory [Shinomori]

git-svn-id: https://rathena.svn.sourceforge.net/svnroot/rathena/branches/stable@1312 54d463be-8e91-2dee-dedb-b68131a5f0ec
---
 src/common/timer.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/src/common/timer.c b/src/common/timer.c
index 954582134..6bf5cdbda 100644
--- a/src/common/timer.c
+++ b/src/common/timer.c
@@ -294,11 +294,18 @@ int do_timer(unsigned int tick) {
 void timer_final() {
 	struct timer_func_list* tfl = tfl_root, *tfl2;
 
+//	while (tfl) {
+//		tfl2 = tfl;
+//		aFree(tfl->name);
+//		aFree(tfl);
+//		tfl = tfl2->next; // access on already freed memory
+//	}
+
 	while (tfl) {
-		tfl2 = tfl;
-		aFree(tfl->name);
+		tfl2 = tfl->next;	// copy next pointer
+		aFree(tfl->name);	// free structures
 		aFree(tfl);
-		tfl = tfl2->next;
+		tfl = tfl2;			// use copied pointer for next cycle
 	}
 	
 	if (timer_data) aFree(timer_data);
-- 
cgit v1.2.3-70-g09d2