Fux use-after-free in srun

This commit fixes a bug in the multi-prog handling. When running
salloc -N 2 srun -O --multi-prog mp.conf where mp.conf reads

0-192 true

srun crashes can be observed. valgrind reports:

==6857== Invalid read of size 4
==6857==    at 0x45938D: bit_realloc (bitstring.c:189)
==6857==    by 0x5977A9: _update_task_mask (multi_prog.c:335)
==6857==    by 0x597A5E: _validate_ranks (multi_prog.c:403)
==6857==    by 0x597D1E: verify_multi_name (multi_prog.c:469)
==6857==    by 0x6E7B4BE: launch_p_handle_multi_prog_verify (launch_slurm.c:453)
==6857==    by 0x58A25D: launch_g_handle_multi_prog_verify (launch.c:493)
==6857==    by 0x58E556: _opt_args (opt.c:1927)
==6857==    by 0x58A3B9: initialize_and_process_args (opt.c:270)
==6857==    by 0x591F82: init_srun (srun_job.c:459)
==6857==    by 0x427E70: srun (srun.c:193)
==6857==    by 0x428E23: main (srun.wrapper.c:17)
==6857==  Address 0x5ace440 is 16 bytes inside a block of size 28 free'd
==6857==    at 0x4C2BB4A: realloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==6857==    by 0x446886: slurm_xrealloc (xmalloc.c:139)
==6857==    by 0x45944C: bit_realloc (bitstring.c:191)
==6857==    by 0x5977A9: _update_task_mask (multi_prog.c:335)
==6857==    by 0x597A5E: _validate_ranks (multi_prog.c:403)
==6857==    by 0x597D1E: verify_multi_name (multi_prog.c:469)
==6857==    by 0x6E7B4BE: launch_p_handle_multi_prog_verify (launch_slurm.c:453)
==6857==    by 0x58A25D: launch_g_handle_multi_prog_verify (launch.c:493)
==6857==    by 0x58E556: _opt_args (opt.c:1927)
==6857==    by 0x58A3B9: initialize_and_process_args (opt.c:270)
==6857==    by 0x591F82: init_srun (srun_job.c:459)
==6857==    by 0x427E70: srun (srun.c:193)

src/srun/libsrun/multi_prog.c

@@ -311,7 +311,7 @@ mpir_dump_proctable(void)
 
 static int
 _update_task_mask(int low_num, int high_num, int *ntasks, bool *ntasks_set,
-		  bitstr_t *task_mask, bool ignore_duplicates)
+		  bitstr_t **task_mask, bool ignore_duplicates)
 {
 	int i;
 
@@ -332,24 +332,24 @@ _update_task_mask(int low_num, int high_num, int *ntasks, bool *ntasks_set,
 			*ntasks = high_num + 1;
 			*ntasks_set = true;
 			i_set_ntasks = true;
-			task_mask = bit_realloc(task_mask, *ntasks);
+			(*task_mask) = bit_realloc((*task_mask), *ntasks);
 		}
 	}
 	for (i=low_num; i<=high_num; i++) {
-		if (bit_test(task_mask, i)) {
+		if (bit_test((*task_mask), i)) {
 			if (ignore_duplicates)
 				continue;
 			error("Duplicate record for task %d", i);
 			return -1;
 		}
-		bit_set(task_mask, i);
+		bit_set((*task_mask), i);
 	}
 	return 0;
 }
 
 static int
 _validate_ranks(char *ranks, int *ntasks, bool *ntasks_set, int32_t *ncmds,
-		bitstr_t *task_mask)
+		bitstr_t **task_mask)
 {
 	static bool has_asterisk = false;
 	char *range = NULL, *p = NULL;
@@ -467,7 +467,7 @@ verify_multi_name(char *config_fname, int *ntasks, bool *ntasks_set,
 			goto fini;
 		}
 		if (_validate_ranks(ranks, ntasks, ntasks_set, ncmds,
-				    task_mask)) {
+				    &task_mask)) {
 			error("Line %d of configuration file %s invalid",
 				line_num, config_fname);
 			rc = -1;