There is a signal handle problem in vsftpd-1.2.1-2.

The SIGCHLD handle is a complexe function with malloc()s and free()s
inside. Neither malloc() nor free() is re-entrant, so the SIGCHLD
signal must be caught only at safe locations.

This is not the case:

// Pseudo-code
standalone.c:
    unblock_signal(SIGCHLD)
    socket = my_accept(...)
    block_signal(SIGCHLD)

sysutil.c:
    my_accept(...) {
        malloc(...)   // BUG: may be interrupted!
        free(...)     // BUG: may be interrupted!
        accept(...)
    }
// End

The unblock/block mecanism must be used more strictly around the
blocking systems calls. A patch follows. Hopefully, it will fix
bug 109933.