# 
# patch "ChangeLog"
#  from [a59353eba9a3615c55816df2870714b3dce6f9f1]
#    to [bdf39a53f4a1e9026721dcf3c85146d53f0dde8a]
# 
# patch "botan/mem_pool.cpp"
#  from [3b09bd3c3d6fdf3aa854529239e9d4e4d8ac18f5]
#    to [54ee4313712d9f47ad38cdfc5ad00d890d607de5]
# 
========================================================================
--- ChangeLog	a59353eba9a3615c55816df2870714b3dce6f9f1
+++ ChangeLog	bdf39a53f4a1e9026721dcf3c85146d53f0dde8a
@@ -1,3 +1,14 @@
+2005-11-26  Matthew Gregan  <address@hidden>
+
+	* botan/mem_pool.cpp (Pooling_Allocator::allocate): Botan's
+	Pooling_Allocator assumes that Buffers stored in free_list are
+	sorted, and uses std::inplace_merge() in deallocate() to ensure
+	the recently freed Buffer is positioned in free_list
+	appropriately.  This same check was not being performed when a
+	Buffer was added to free_list in allocate() (it's not safe to
+	assume that the address of a newly allocated Buffer will always be
+	greated than existing Buffers).
+
 2005-11-25  graydon hoare  <address@hidden>
 
 	* database.cc (get_version): Another important fix: make sure to
========================================================================
--- botan/mem_pool.cpp	3b09bd3c3d6fdf3aa854529239e9d4e4d8ac18f5
+++ botan/mem_pool.cpp	54ee4313712d9f47ad38cdfc5ad00d890d607de5
@@ -159,6 +159,9 @@
    if(!block.buf)
       throw Memory_Exhaustion();
    free_list.push_back(block);
+   if(free_list.size() >= 2)
+      std::inplace_merge(free_list.begin(), free_list.end() - 1,
+                         free_list.end());
 
    new_buf = find_free_block(n);
    if(new_buf)