posix_spawn_file_actions_destroy: fix a crash

[Bruno Haible]

Calling free() on a wrong value can produce a crash.


2020-04-28  Bruno Haible  <br...@clisp.org>

        posix_spawn_file_actions_destroy: Fix a crash (bug from 2019-06-10).
        * lib/spawn_faction_destroy.c (posix_spawn_file_actions_destroy): Don't
        access elements of the wrong union member.

diff --git a/lib/spawn_faction_destroy.c b/lib/spawn_faction_destroy.c
index 906797b..e9985f4 100644
--- a/lib/spawn_faction_destroy.c
+++ b/lib/spawn_faction_destroy.c
@@ -42,9 +42,11 @@ posix_spawn_file_actions_destroy (posix_spawn_file_actions_t 
*file_actions)
       switch (sa->tag)
         {
         case spawn_do_open:
-        case spawn_do_chdir:
           free (sa->action.open_action.path);
           break;
+        case spawn_do_chdir:
+          free (sa->action.chdir_action.path);
+          break;
         default:
           /* No cleanup required.  */
           break;