[Xapian-tickets] [Xapian] #696: Use after free with WILDCARD_LIMIT_MOST_FREQUENT (was: Segfault/OOM in git master)

[Xapian]

#696: Use after free with WILDCARD_LIMIT_MOST_FREQUENT
-----------------------------------------------+---------------------------
 Reporter:  coventry                           |             Owner:  olly
     Type:  defect                             |            Status:
                                               |  assigned
 Priority:  normal                             |         Milestone:  1.3.4
Component:  Library API                        |           Version:  1.3.3
 Severity:  major                              |        Resolution:
 Keywords:  1.3.3 segfault git master 9c9213d  |        Blocked By:
 Blocking:                                     |  Operating System:  Linux
-----------------------------------------------+---------------------------
Changes (by olly):

 * status:  new => assigned
 * component:  Xapian-bindings (Python) => Library API
 * version:  other => 1.3.3
 * milestone:  1.3.x => 1.3.4
 * owner:  richard => olly


Comment:

 OK, have reproduced this (and directly from C++), so no need for the
 above.

 The issue is with `Xapian::Query::WILDCARD_LIMIT_MOST_FREQUENT`, which
 `QueryParser` defaults to using for FLAG_PARTIAL - this can delete the
 `PostList` object which `*hint` points to.  That wildcard limit option was
 new in 1.3.3, so this doesn't affect anything earlier (or 1.2.x).

--
Ticket URL: <http://trac.xapian.org/ticket/696#comment:6>
Xapian <http://xapian.org/>
Xapian