Comment 1 for bug 589574

Revision history for this message
Christopher Hall (hsw) wrote :

Definitely use after free - tested by remarking the free() call in alloc.c.
After this change the invalid tags show as <big> and </big>.

Code to do this was introduced in parse.c 1.178 title: "inline propagation"

A work around is to remove this patch; but simply commenting out the call
to InlineDup1 on line 1535 is sufficient.
This file was at 1.188 at the time of testing this.

The code in the InlineDup1 (istack.c) was introduced by the same patch.