Please sign in to comment.
Bug #27312862: ASAN: HEAP-USE-AFTER-FREE: UPDATEXML RB#21666 RB#21666
The xpath parsing function was using a local string buffer that was deallocated when going out of scope. However references to it are preserved in the XPATH parse tree. This was causing read-after-free. Fixed by making the xpath buffer a local variable inside the Item class for the relevant xpath function, thus being preserved for the duration of the query.
- Loading branch information...
Showing with 6 additions and 6 deletions.