Use-after-free in _nc_free_and_exit()

[Miroslav Lichvar]

I'm looking at a report from a static analyser and there seems to be
one issue that looks like an actual bug, which in a test is reported
by valgrind too. In the "leaky" configuration of ncurses there is:

NCURSES_SP_NAME(_nc_free_and_exit) (NCURSES_SP_DCLx int code)
{
    if (SP_PARM) {
        delscreen(SP_PARM);
        if (SP_PARM->_term)
            NCURSES_SP_NAME(del_curterm) (NCURSES_SP_ARGx SP_PARM->_term);
    }

delscreen() frees SP_PARM, so it shouldn't be accessed after that
point. The _term seems to be freed in delscreen(), so maybe those two
lines following the delscreen() could be removed?

-- 
Miroslav Lichvar