25 Oct
2025
25 Oct
'25
3:59 a.m.
In domelem_removeAttributeNode, we call xmlRemoveProp if attributeNode is NULL. Doing this frees the xmlNodePtr, leaving a dangling pointer. Which later in domattr_Release causes a use-after-free. Found by ASan. -- https://gitlab.winehq.org/wine/wine/-/merge_requests/9279