* eval_method.c (rb_get_method_body): ent->method may be freed by

  GC.  [ruby-dev:31819]

* thread.c (remove_event_hook): should not access freed memory.
  [ruby-dev:31820]

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@15654 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

1 files changed, 6 insertions, 3 deletions

diff --git a/thread.c b/thread.c
index d199a39645..8fc6dd9245 100644
--- a/thread.c
+++ b/thread.c
@@ -2757,9 +2757,10 @@ rb_add_event_hook(rb_event_hook_func_t func, rb_event_flag_t events, VALUE data)
 static int
 remove_event_hook(rb_event_hook_t **root, rb_event_hook_func_t func)
 {
-    rb_event_hook_t *prev = NULL, *hook = *root;
+    rb_event_hook_t *prev = NULL, *hook = *root, *next;
 
     while (hook) {
+	next = hook->next;
 	if (func == 0 || hook->func == func) {
 	    if (prev) {
 		prev->next = hook->next;
@@ -2769,8 +2770,10 @@ remove_event_hook(rb_event_hook_t **root, rb_event_hook_func_t func)
 	    }
 	    xfree(hook);
 	}
-	prev = hook;
-	hook = hook->next;
+	else {
+	    prev = hook;
+	}
+	hook = next;
     }
     return -1;
 }