2.6.x signal handler bug

[Paul Maurides <stud1313@di.uoa.gr>]

The bug has been reproduced successfully using the following program
on kernel 2.6.5 and 2.6.7, and probably affects any other 2.6 kernel.

Kernel 2.4 produce the correct behavior, an endless loop of handled 
signals, but on kernel 2.6 the program segfaults.

#include <signal.h>
#include <stdio.h>
#include <stdlib.h>
#include <setjmp.h>

volatile int len;
volatile int real;
volatile int caught;
jmp_buf env;

void catcher(int sig){
    signal(SIGSEGV,catcher);
    printf("requested: %9d malloced: %9d\n",len,real);
    longjmp(env, 1);
}

int main(){
    char* p=0;
    len = 0;
    signal(SIGSEGV,catcher);

    setjmp(env);
    len++;
    free(p);
    p = malloc(len);
    real = 0;
    while(1){
        p[real] = 0;
        real++;
    }
    return 0;
}

PS. I'm not subscribed to this list, so please include me in the cc