Subject: bug#11787: Potential use after free bug in coreutils 8.17

From: "Xu Zhongxing" <[email-masked]>
Date: Tue, 26 Jun 2012 13:01:13 +0800 (CST)

In Coreutils 8.17, csplit.c, static bool load_buffer (void)

On line 503 and 511, b is passed to free_buffer() twice. This could lead to a use-after-free bug in free_buffer(): struct line *n = l->next;, where buf->line_start is freed in the first call of free_buffer().

- Xu Zhongxing