Fix access to freed members of a dead thread

* threads.c: Fix access to freed members of a dead thread. Found
and fixed by Rodrigo Kumpera <rkumpera@novell.com>
Ref: CVE-2011-0992

diff --git a/mono/metadata/threads.c b/mono/metadata/threads.c
index 3fe4e9302bb4bb6ba369e50a4c66b0adb6e2f516..a7a721dca8509d2a6670cdacf482e8e3c4493948 100644 (file)
--- a/mono/metadata/threads.c
+++ b/mono/metadata/threads.c
@@ -1036,12 +1036,17 @@ void ves_icall_System_Threading_InternalThread_Thread_free_internal (MonoInterna
                CloseHandle (thread);
 
        if (this->synch_cs) {
                CloseHandle (thread);
 
        if (this->synch_cs) {

-               DeleteCriticalSection (this->synch_cs);
-               g_free (this->synch_cs);
+               CRITICAL_SECTION *synch_cs = this->synch_cs;

                this->synch_cs = NULL;
                this->synch_cs = NULL;

+               DeleteCriticalSection (synch_cs);
+               g_free (synch_cs);

        }
 
        }
 

-       g_free (this->name);
+       if (this->name) {
+               void *name = this->name;
+               this->name = NULL;
+               g_free (name);
+       }

 }
 
 static void mono_thread_start (MonoThread *thread)
 }
 
 static void mono_thread_start (MonoThread *thread)