j
k
j a
j l
In domelem_removeAttributeNode, we call xmlRemoveProp if attributeNode is NULL. Doing this frees the xmlNodePtr, leaving a dangling pointer. Which later in domattr_Release causes a use-after-free.
Found by ASan.
Back to the thread
Back to the list