SIGSEGV in DeleteCert called from child-termination signal handler

[michaelrsweet]

Version: 1.1.19
CUPS.org User: wolfram.joost.dak

The signal-handler for terminated child-processes calls the funtion DeleteCert. DeleteCert uses the function free which isn't reentrant (http://www.gnu.org/software/libc/manual/html_node/Nonreentrancy.html). This can cause a SIGSEGV:

Core was generated by `/usr/sbin/cupsd'.
Program terminated with signal 11, Segmentation fault.
#0 0x4020a763 in chunk_free () from /lib/i686/libc.so.6
#1 0x4020a666 in free () from /lib/i686/libc.so.6
#2 0x0804eddb in DeleteCert (pid=25740) at cert.c:182
#3 0x0805ef98 in sigchld_handler (sig=17) at main.c:1032
#4
#5 0x4020a85b in chunk_free () from /lib/i686/libc.so.6
#6 0x4020a666 in free () from /lib/i686/libc.so.6
#7 0x40079f3d in CRYPTO_free () from /usr/lib/libcrypto.so.0.9.6
#8 0x08051189 in ReadClient (con=0x402cf668) at client.c:1935
#9 0x0805df5f in main (argc=1, argv=0xbffffe44) at main.c:591
#10 0x401b44c2 in __libc_start_main () from /lib/i686/libc.so.6

[michaelrsweet]

CUPS.org User: mike

This is already fixed in 1.1.20. Please upgrade.