A bug fix from Alexey V. Neyman:

    In case of vfork(), the parent was left with __exit_count of -1 and
    thus tried to find non-NULL value of __exit_function_table[-1].atexit,
    __exit_function_table[-2].atexit and call this function; of course, it
    leads to coredump.

diff --git a/libc/stdlib/atexit.c b/libc/stdlib/atexit.c
index e4b6620..44abc34 100644 (file)
--- a/libc/stdlib/atexit.c
+++ b/libc/stdlib/atexit.c
@@ -147,8 +147,8 @@ void __exit_handler(int status)
        struct exit_function *efp;
 
        /* In reverse order */
-       for ( ; __exit_count-- ; ) {
-               efp = &__exit_function_table[__exit_count];
+       while ( __exit_count ) {
+               efp = &__exit_function_table[--__exit_count];
                switch (efp->type) {
                case ef_on_exit:
                        if (efp->funcs.on_exit.func) {