From 19bb578358dc06c14f62c20ccfecd23ed1dca75f Mon Sep 17 00:00:00 2001
From: Joerg Wunsch <joerg@FreeBSD.org>
Date: Mon, 28 Oct 1996 07:47:34 +0000
Subject: [PATCH] Don't dereference a free()ed pointer.

Closes PR bin/1909: 'last' coredumps if MALLOC_OPTIONS...
---
 usr.bin/last/last.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/usr.bin/last/last.c b/usr.bin/last/last.c
index 89dcef8eff81..25a762742c53 100644
--- a/usr.bin/last/last.c
+++ b/usr.bin/last/last.c
@@ -162,7 +162,7 @@ void
 wtmp()
 {
 	struct utmp	*bp;			/* current structure */
-	struct ttytab	*tt;				/* ttylist entry */
+	struct ttytab	*tt, *ttx;		/* ttylist entry */
 	struct stat	stb;			/* stat of file for size */
 	long	bl, delta;			/* time difference */
 	int	bytes, wfd;
@@ -191,9 +191,11 @@ wtmp()
 			 */
 			if (bp->ut_line[0] == '~' && !bp->ut_line[1]) {
 				/* everybody just logged out */
-				for (tt = ttylist.lh_first; tt; tt = tt->list.le_next) {
+				for (tt = ttylist.lh_first; tt;) {
 					LIST_REMOVE(tt, list);
-					free(tt);
+					ttx = tt;
+					tt = tt->list.le_next;
+					free(ttx);
 				}
 				currentout = -bp->ut_time;
 				crmsg = strncmp(bp->ut_name, "shutdown",