diff options
| author | Allan Sandfeld Jensen <allan.jensen@qt.io> | 2017-12-15 11:40:57 +0100 |
|---|---|---|
| committer | Allan Sandfeld Jensen <allan.jensen@qt.io> | 2018-01-25 21:39:52 +0000 |
| commit | 3585d2269ba2d9777e3afccef026d1e159f47f5d (patch) | |
| tree | e2ea2a8e3a1c22f36761653311d25bfcdd14b198 /src/xmlpatterns/expr/qevaluationcache_p.h | |
| parent | 0a84ad44ff5b793316485fd992326627a70fda84 (diff) | |
| download | qtxmlpatterns-3585d2269ba2d9777e3afccef026d1e159f47f5d.tar.gz | |
Fix access after free in evaluation cache
If a let expression is compressed away to just its value, let the
value keep a reference to the variable declaration.
Task-number: QTBUG-63613
Change-Id: I544ca682627c0fc0fe13984602aefbaaf3df4533
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
Diffstat (limited to 'src/xmlpatterns/expr/qevaluationcache_p.h')
| -rw-r--r-- | src/xmlpatterns/expr/qevaluationcache_p.h | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/xmlpatterns/expr/qevaluationcache_p.h b/src/xmlpatterns/expr/qevaluationcache_p.h index 6c2efc7..d3ac422 100644 --- a/src/xmlpatterns/expr/qevaluationcache_p.h +++ b/src/xmlpatterns/expr/qevaluationcache_p.h @@ -120,7 +120,7 @@ namespace QPatternist private: static DynamicContext::Ptr topFocusContext(const DynamicContext::Ptr &context); - const VariableDeclaration* m_declaration; + const VariableDeclaration::Ptr m_declaration; /** * This variable must not be called m_slot. If it so, a compiler bug on * HP-UX-aCC-64 is triggered in the constructor initializor. See the |