Skip to content

Commit d3a819c

Browse files
committed
Fix & regression test for use-after-free introduced in bb117ff
tldr, avoid freeing memory before passing it along to another function.
1 parent 6e186b3 commit d3a819c

File tree

2 files changed

+17
-2
lines changed

2 files changed

+17
-2
lines changed

src/inlines.c

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1178,6 +1178,7 @@ static cmark_node *handle_close_bracket(cmark_parser *parser, subject *subj) {
11781178
// being replacing the opening '[' text node with a `^footnote-ref]` node.
11791179
cmark_node_insert_before(opener->inl_text, fnref);
11801180

1181+
process_emphasis(parser, subj, opener->previous_delimiter);
11811182
// sometimes, the footnote reference text gets parsed into multiple nodes
11821183
// i.e. '[^example]' parsed into '[', '^exam', 'ple]'.
11831184
// this happens for ex with the autolink extension. when the autolinker
@@ -1191,8 +1192,6 @@ static cmark_node *handle_close_bracket(cmark_parser *parser, subject *subj) {
11911192
// the opener->inl_text->next.
11921193
//
11931194
// therefore, here we walk thru the list and free them all up
1194-
process_emphasis(parser, subj, opener->previous_delimiter);
1195-
11961195
cmark_node *next_node;
11971196
cmark_node *current_node = opener->inl_text->next;
11981197
while(current_node) {

test/regression.txt

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -338,3 +338,19 @@ It has another footnote that contains many different characters (the autolinker
338338
</ol>
339339
</section>
340340
````````````````````````````````
341+
342+
Footnotes interacting with strikethrough should not lead to a use-after-free
343+
344+
```````````````````````````````` example footnotes autolink strikethrough table
345+
|Tot.....[^_a_]|
346+
.
347+
<p>|Tot.....[^_a_]|</p>
348+
````````````````````````````````
349+
350+
Footnotes interacting with strikethrough should not lead to a use-after-free pt2
351+
352+
```````````````````````````````` example footnotes autolink strikethrough table
353+
[^~~is~~1]
354+
.
355+
<p>[^~~is~~1]</p>
356+
````````````````````````````````

0 commit comments

Comments
 (0)