Oct. 24, 2025
10:59 p.m.
In domelem_removeAttributeNode, we call xmlRemoveProp if attributeNode is NULL. Doing this frees the xmlNodePtr, leaving a dangling pointer. Which later in domattr_Release causes a use-after-free. Found by ASan. -- https://gitlab.winehq.org/wine/wine/-/merge_requests/9279