SERVER-5081 do not delete iterator until after it's incremented

Avoids memory reads of freed memory.

1 files changed, 6 insertions, 3 deletions

diff --git a/db/repl/rs.cpp b/db/repl/rs.cpp
index f827291c3f3..23abc24931d 100644
--- a/db/repl/rs.cpp
+++ b/db/repl/rs.cpp
@@ -100,17 +100,20 @@ namespace mongo {
         lock lk(this);
 
         Member *max = 0;
-
-        for (set<unsigned>::iterator it = _electableSet.begin(); it != _electableSet.end(); it++) {
+        set<unsigned>::iterator it = _electableSet.begin();
+        while ( it != _electableSet.end() ) {
             const Member *temp = findById(*it);
             if (!temp) {
                 log() << "couldn't find member: " << *it << endl;
-                _electableSet.erase(*it);
+                set<unsigned>::iterator it_delete = it;
+                it++;
+                _electableSet.erase(it_delete);
                 continue;
             }
             if (!max || max->config().priority < temp->config().priority) {
                 max = (Member*)temp;
             }
+            it++;
         }
 
         return max;