crash on reconfig

 Hi !

 There is another bug in xinetd.  Sometimes it crashed on reconfig with
deleting services at (gdb5):
#0  0x0003b278 in filelog_write (xp=0x76670,
    buf=0xffbeec58 "EXIT: hadm pid=24777 duration=886(sec)", len=38, flags=4,
    ap=0xffbeec2c) at filelog.c:190
#1  0x0003a97c in xlog_write (pxlog=0x76670,
    buf=0xffbeec58 "EXIT: hadm pid=24777 duration=886(sec)", len=38, flags=4)
    at xlog.c:190
#2  0x000217fc in svc_log_exit (sp=0x10ffb0, serp=0x11d068) at log.c:213
#3  0x0002e670 in svc_postmortem (sp=0x10ffb0, serp=0x11d068) at service. c:880
#4  0x0002c51c in server_end (serp=0x11d068) at server.c:300
#5  0x00028660 in sendsig (serp=0x11d068, sig=9) at reconfig.c:249
#6  0x00028728 in deliver_signal (sp=0x10ffb0, sig=9) at reconfig.c:272
#7  0x00028798 in terminate_servers (sp=0x10ffb0) at reconfig.c:284
#8  0x000281fc in hard_reconfig () at reconfig.c:135
#9  0x0002f594 in check_pipe () at signals.c:561
#10 0x00022218 in main_loop () at main.c:153
#11 0x00021f5c in main (argc=9, argv=0xffbef98c) at main.c:88

(gdb) list
190             if ( flp->fl_state != FL_OPEN )
191                     return( flp->fl_error ) ;

gdb) p xp
$7 = (xlog_s *) 0x76670

(gdb) p *xp
$8 = {
  xl_type = XLOG_FILELOG,
  xl_id = 0xf0880 "default",
  xl_flags = 0,
  xl_callback = 0x21a3c <log_in_error>,
  xl_callback_arg = 0xecbc0,
  xl_use = 0x0,
  xl_clients = 0x0,
  xl_other_users = {
    next = 0x400000,
    prev = 0x1e6
  },
  xl_ops = 0x5363c,
  xl_data = 0x0
}

 I suppose that happened next:

1) hard_reconfig()->cnf_get() started and we have got new_conf without some
   services
2) in swap_defaults() we free() DEFAULT_LOG(ps)->xl_data and then
    free(DEFAULT_LOG(ps). After that all services'  svc_log pointed to
    free memory ( 0x76670 - previous address of DEFAULT_LOG(ps)).
3) then for each service which remained in config we call reajust() and
   recreate DEFAULT_LOG(ps) in restart_log() (VERY IMPOTANT). After recreating
   DEFAULT_LOG(ps) all refreshed services pointed to it.
4) then for services with drop_service==YES we call  terminate_servers()
   and inside it call xlog_write(pxlog,..). BUT pxlog pointed to 0x76670 - address
   of previous freed DEFAULT_LOG(ps) with xl_data==NULL, and when it try to
   dereference xl_data it get SIGSEGV.

 And now about VERY IMPOTANT - very often malloc() for new DEFAULT_LOG(ps)
returns same address as for previous DEFAULT_LOG(ps). So svc_log in terminated
services pointed to valid new DEFAULT_LOG(ps). But sometimes malloc() return
new address and core generated.
 In first sight this error may be easy find with malloc() debugger like Electric
Fence. But perhaps no Electric Fence not Purify not find this error because
this address (0x76670) already member another allocated memory block in this time?

--
   Dmitry Perfilyev