From cfce51b0ca61755e5fe7758ffcca9f434812e887 Mon Sep 17 00:00:00 2001
From: William Hubbs <w.d.hubbs@gmail.com>
Date: Sat, 10 Jan 2015 15:26:49 -0600
Subject: [PATCH] fix double free

---
 src/librc/librc-daemon.c | 21 +++++++++++----------
 1 file changed, 11 insertions(+), 10 deletions(-)

diff --git a/src/librc/librc-daemon.c b/src/librc/librc-daemon.c
index 02aff5a..c333a1c 100644
--- a/src/librc/librc-daemon.c
+++ b/src/librc/librc-daemon.c
@@ -500,6 +500,8 @@ rc_service_daemons_crashed(const char *service)
 	char *exec = NULL;
 	char *name = NULL;
 	char *pidfile = NULL;
+	char *ch_root = NULL;
+	char *spidfile = NULL;
 	pid_t pid = 0;
 	RC_PIDLIST *pids;
 	RC_PID *p1;
@@ -554,28 +556,27 @@ rc_service_daemons_crashed(const char *service)
 		}
 		fclose(fp);
 
-		char *ch_root = rc_service_value_get(basename_c(service), "chroot");
-		char *spidfile = pidfile;
+		ch_root = rc_service_value_get(basename_c(service), "chroot");
 		if (ch_root && pidfile) {
 			spidfile = xmalloc(strlen(ch_root) + strlen(pidfile) + 1);
 			strcpy(spidfile, ch_root);
 			strcat(spidfile, pidfile);
+			pidfile = xrealloc(pidfile, strlen(spidfile) + 1);
+			strcpy(pidfile, spidfile);
+			free(spidfile);
+			spidfile = NULL;
 		}
 
 		pid = 0;
-		if (spidfile) {
+		if (pidfile) {
 			retval = true;
-			if ((fp = fopen(spidfile, "r"))) {
+			if ((fp = fopen(pidfile, "r"))) {
 				if (fscanf(fp, "%d", &pid) == 1)
 					retval = false;
 				fclose(fp);
 			}
-			free(spidfile);
-			spidfile = NULL;
-			if (ch_root) {
-				free(pidfile);
-				pidfile = NULL;
-			}
+			free(pidfile);
+			pidfile = NULL;
 
 			/* We have the pid, so no need to match
 			   on exec or name */
-- 
2.0.5