crosstabs: Fix free of bad pointer and use-after-free error in cleanup.

In free_proc, 'pt' points within an array that is dynamically
allocated, not to a data structure that is dynamically allocated, so
we must not try to free it on each iteration.  Instead, free the
dynamic array itself (proc->pivots) only once.

diff --git a/src/language/stats/crosstabs.q b/src/language/stats/crosstabs.q
index 76cae1b30e1f334a3f9a19a7b8a1ab1d2a2bda87..1d35e14e83e0de27b50d451feb2beb62671c8e76 100644 (file)
--- a/src/language/stats/crosstabs.q
+++ b/src/language/stats/crosstabs.q
@@ -234,8 +234,8 @@ free_proc (struct crosstabs_proc *proc)
 
          The rest of the data was allocated and destroyed at a
          lower level already. */
-      free (pt);
     }
+  free (proc->pivots);
 }
 
 static int internal_cmd_crosstabs (struct lexer *lexer, struct dataset *ds,