Fix invalid read in ROC vs. TEMP

Partial fix for bug #38833

diff --git a/src/language/stats/roc.c b/src/language/stats/roc.c
index 471b946ee817b17124836b4f601d9358fbd833cf..031314cd3972a70abba559c4a39cfe0574ad8a3a 100644 (file)
--- a/src/language/stats/roc.c
+++ b/src/language/stats/roc.c
@@ -49,6 +49,7 @@ struct cmd_roc
 
   const struct variable *state_var;
   union value state_value;
+  size_t state_var_width;
 
   /* Plot the roc curve */
   bool curve;
@@ -94,6 +95,7 @@ cmd_roc (struct lexer *lexer, struct dataset *ds)
   roc.neg = roc.neg_weighted = 0;
   roc.dict = dataset_dict (ds);
   roc.state_var = NULL;
+  roc.state_var_width = -1;
 
   lex_match (lexer, T_SLASH);
   if (!parse_variables_const (lexer, dict, &roc.vars, &roc.n_vars,
@@ -112,7 +114,8 @@ cmd_roc (struct lexer *lexer, struct dataset *ds)
       goto error;
     }
 
-  value_init (&roc.state_value, var_get_width (roc.state_var));
+  roc.state_var_width = var_get_width (roc.state_var);
+  value_init (&roc.state_value, roc.state_var_width);
   parse_value (lexer, &roc.state_value, roc.state_var);
 
 
@@ -121,7 +124,6 @@ cmd_roc (struct lexer *lexer, struct dataset *ds)
       goto error;
     }
 
-
   while (lex_token (lexer) != T_ENDCMD)
     {
       lex_match (lexer, T_SLASH);
@@ -272,13 +274,14 @@ cmd_roc (struct lexer *lexer, struct dataset *ds)
   if ( ! run_roc (ds, &roc)) 
     goto error;
 
-  value_destroy (&roc.state_value, var_get_width (roc.state_var));
+  if ( roc.state_var)
+    value_destroy (&roc.state_value, roc.state_var_width);
   free (roc.vars);
   return CMD_SUCCESS;
 
  error:
   if ( roc.state_var)
-    value_destroy (&roc.state_value, var_get_width (roc.state_var));
+    value_destroy (&roc.state_value, roc.state_var_width);
   free (roc.vars);
   return CMD_FAILURE;
 }