pike.git/ src/ language.yacc

2013-10-28

2013-10-28 14:45:31 by Arne Goedeke <el@laramies.com>

• efd3b6352aee0f6f8a19115c38da0260ab89e886 (11 lines) (+4/-7) ^{[ Show | Annotate ]}
  Branch: 7.9

Compiler: Fix use-after-free

When using an argument in several nodes, the refcount needs to be
incremented accordingly.

3610:    /* A?[X] to ((tmp=A) && tmp[X]) */    if( $1->token == F_LOCAL )    { -  $$=mknode(F_LAND, $1, mknode(F_INDEX, $1, $4)); +  $$=mknode(F_LAND, copy_node($1), mknode(F_INDEX, $1, $4));    }    else    {
3642:    node *range = mknode(':',$4,$6);    if( $1->token == F_LOCAL )    { -  $$ = mknode( F_LAND, $1, mknode(F_RANGE, $1, range) ); +  $$ = mknode( F_LAND, copy_node($1), mknode(F_RANGE, $1, range) );    }    else    {
3666:    }    COPY_LINE_NUMBER_INFO($$, $3);    free_node ($3); -  -  -  COPY_LINE_NUMBER_INFO($$, $3); -  free_node ($3); +     }    | expr4 open_bracket_with_line_info error ']'    {
3760:    int temporary;    if( $1->token == F_LOCAL )    { -  $$=mknode(F_LAND, $1, mknode(F_ARROW, $1, $4)); +  $$=mknode(F_LAND, copy_node($1), mknode(F_ARROW, $1, $4));    }    else    {