Use after free, in bruteforce.h

[davidshoon]

In the following function in hnswlib/bruteforce.h:

void removePoint(labeltype cur_external) {
    std::unique_lock<std::mutex> lock(index_lock);

    auto found = dict_external_to_internal.find(cur_external);
    if (found == dict_external_to_internal.end()) {
        return;
    }
    
    dict_external_to_internal.erase(found);

// found->second is used after it's been freed (above)
// and it's used by cur_c later on.
size_t cur_c = found->second;

    labeltype label = *((labeltype*)(data_ + size_per_element_ * (cur_element_count-1) + data_size_));
    dict_external_to_internal[label] = cur_c;
    memcpy(data_ + size_per_element_ * cur_c,
            data_ + size_per_element_ * (cur_element_count-1),
            data_size_+sizeof(labeltype));
    cur_element_count--;
}

It should be:

void removePoint(labeltype cur_external) {
    std::unique_lock<std::mutex> lock(index_lock);

    auto found = dict_external_to_internal.find(cur_external);
    if (found == dict_external_to_internal.end()) {
        return;
    }

// store a copy of found->second before freeing found...
size_t cur_c = found->second;
dict_external_to_internal.erase(found);

    labeltype label = *((labeltype*)(data_ + size_per_element_ * (cur_element_count-1) + data_size_));
    dict_external_to_internal[label] = cur_c;
    memcpy(data_ + size_per_element_ * cur_c,
            data_ + size_per_element_ * (cur_element_count-1),
            data_size_+sizeof(labeltype));
    cur_element_count--;
}