From 21e27fe9b4cd26d70c7e598b17d8fd892c689bb5 Mon Sep 17 00:00:00 2001
From: kstailey <kstailey@openbsd.org>
Date: Thu, 13 Feb 1997 18:13:31 +0000
Subject: [PATCH] prevent free()ed object from being referenced

---
 sys/netinet/ip_nat.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/sys/netinet/ip_nat.c b/sys/netinet/ip_nat.c
index 2a49950f50e..d671351baf3 100644
--- a/sys/netinet/ip_nat.c
+++ b/sys/netinet/ip_nat.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ip_nat.c,v 1.9 1997/02/12 15:16:02 kstailey Exp $	*/
+/*	$OpenBSD: ip_nat.c,v 1.10 1997/02/13 18:13:31 kstailey Exp $	*/
 /*
  * (C)opyright 1995-1996 by Darren Reed.
  *
@@ -22,7 +22,9 @@ static	char	rcsid[] = "Id: ip_nat.c,v 2.0.1.10 1997/02/08 06:38:49 darrenr Exp";
 # include <stdlib.h>
 #endif
 #include <sys/errno.h>
-#include <sys/types.h>
+#ifndef __OpenBSD__
+# include <sys/types.h>
+#endif
 #include <sys/param.h>
 #include <sys/file.h>
 #include <sys/ioctl.h>
@@ -903,9 +905,11 @@ ip_natexpire()
 
 	MUTEX_ENTER(&ipf_nat);
 	SPLNET(s);
-	for (natp = &nat_instances; (nat = *natp); natp = &nat->nat_next) {
-		if (--nat->nat_age)
+	for (natp = &nat_instances; (nat = *natp); ) {
+		if (--nat->nat_age) {
+			natp = &nat->nat_next;
 			continue;
+		}
 		*natp = nat->nat_next;
 		nat_delete(nat);
 		nat_stats.ns_expire++;
-- 
2.20.1