FLIP: Fix use-after-free error with temporary transformations. 20130426010504/pspp
authorBen Pfaff <blp@cs.stanford.edu>
Fri, 26 Apr 2013 06:03:45 +0000 (23:03 -0700)
committerBen Pfaff <blp@cs.stanford.edu>
Fri, 26 Apr 2013 06:03:45 +0000 (23:03 -0700)
commit32095bce3308fc041df4b928adbf23e26098f19d
tree5c05eee7738a40bb7f5066c6ec9ac69802319b29
parent4e5a6cc044c6c82e6c4d842bf056579b6bc47d48
FLIP: Fix use-after-free error with temporary transformations.

The FLIP procedure keeps a reference to the  dictionary from before running
a procedure and then uses that reference after calling proc_commit().  When
temporary transformations are present, this dictionary disappears.  The
"SPLIT FILE  - vs procedures" test triggers this issue because it uses
FILTER, which is implemented as a temporary transformation.

This commit fixes the problem by avoiding a reference to the old
dictionary after proc_commit().

Reported by John Darrington.
Bug #38820.
src/language/stats/flip.c
tests/language/dictionary/split-file.at