summaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
authorAllan Sandfeld Jensen <allan.jensen@qt.io>2017-12-15 11:40:57 +0100
committerAllan Sandfeld Jensen <allan.jensen@qt.io>2018-01-25 21:39:52 +0000
commit3585d2269ba2d9777e3afccef026d1e159f47f5d (patch)
treee2ea2a8e3a1c22f36761653311d25bfcdd14b198 /src
parent0a84ad44ff5b793316485fd992326627a70fda84 (diff)
downloadqtxmlpatterns-3585d2269ba2d9777e3afccef026d1e159f47f5d.tar.gz
Fix access after free in evaluation cache
If a let expression is compressed away to just its value, let the value keep a reference to the variable declaration. Task-number: QTBUG-63613 Change-Id: I544ca682627c0fc0fe13984602aefbaaf3df4533 Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
Diffstat (limited to 'src')
-rw-r--r--src/xmlpatterns/expr/qevaluationcache_p.h2
-rw-r--r--src/xmlpatterns/expr/qevaluationcache_tpl_p.h2
2 files changed, 2 insertions, 2 deletions
diff --git a/src/xmlpatterns/expr/qevaluationcache_p.h b/src/xmlpatterns/expr/qevaluationcache_p.h
index 6c2efc7..d3ac422 100644
--- a/src/xmlpatterns/expr/qevaluationcache_p.h
+++ b/src/xmlpatterns/expr/qevaluationcache_p.h
@@ -120,7 +120,7 @@ namespace QPatternist
private:
static DynamicContext::Ptr topFocusContext(const DynamicContext::Ptr &context);
- const VariableDeclaration* m_declaration;
+ const VariableDeclaration::Ptr m_declaration;
/**
* This variable must not be called m_slot. If it so, a compiler bug on
* HP-UX-aCC-64 is triggered in the constructor initializor. See the
diff --git a/src/xmlpatterns/expr/qevaluationcache_tpl_p.h b/src/xmlpatterns/expr/qevaluationcache_tpl_p.h
index 26f53b5..b8e09a9 100644
--- a/src/xmlpatterns/expr/qevaluationcache_tpl_p.h
+++ b/src/xmlpatterns/expr/qevaluationcache_tpl_p.h
@@ -58,7 +58,7 @@ template<bool IsForGlobal>
EvaluationCache<IsForGlobal>::EvaluationCache(const Expression::Ptr &op,
const VariableDeclaration::Ptr &varDecl,
const VariableSlotID aSlot) : SingleContainer(op)
- , m_declaration(varDecl.constData())
+ , m_declaration(varDecl)
, m_varSlot(aSlot)
{
Q_ASSERT(m_declaration);