From efd3b6352aee0f6f8a19115c38da0260ab89e886 Mon Sep 17 00:00:00 2001
From: Arne Goedeke <el@laramies.com>
Date: Mon, 28 Oct 2013 15:42:14 +0100
Subject: [PATCH] Compiler: Fix use-after-free
When using an argument in several nodes, the refcount needs to be
incremented accordingly.
---
src/language.yacc | 10 +++-------
1 file changed, 3 insertions(+), 7 deletions(-)
diff --git a/src/language.yacc b/src/language.yacc
index 467df33fcd..b4c1a00949 100644
--- a/src/language.yacc
+++ b/src/language.yacc
@@ -3610,7 +3610,7 @@ expr4: string
/* A?[X] to ((tmp=A) && tmp[X]) */
if( $1->token == F_LOCAL )
{
- $$=mknode(F_LAND, $1, mknode(F_INDEX, $1, $4));
+ $$=mknode(F_LAND, copy_node($1), mknode(F_INDEX, $1, $4));
}
else
{
@@ -3642,7 +3642,7 @@ expr4: string
node *range = mknode(':',$4,$6);
if( $1->token == F_LOCAL )
{
- $$ = mknode( F_LAND, $1, mknode(F_RANGE, $1, range) );
+ $$ = mknode( F_LAND, copy_node($1), mknode(F_RANGE, $1, range) );
}
else
{
@@ -3666,10 +3666,6 @@ expr4: string
}
COPY_LINE_NUMBER_INFO($$, $3);
free_node ($3);
-
-
- COPY_LINE_NUMBER_INFO($$, $3);
- free_node ($3);
}
| expr4 open_bracket_with_line_info error ']'
{
@@ -3760,7 +3756,7 @@ expr4: string
int temporary;
if( $1->token == F_LOCAL )
{
- $$=mknode(F_LAND, $1, mknode(F_ARROW, $1, $4));
+ $$=mknode(F_LAND, copy_node($1), mknode(F_ARROW, $1, $4));
}
else
{
--
GitLab