Expr: add missing reference in AssignExpr::InitVal()

The one reference returned by `op2->InitVal()` is given to
`aggr_r->Assign()` and returned to the caller, which may result in a
use-after-free crash bug.  This patch adds the missing reference.

Closes https://github.com/zeek/zeek/issues/805
This commit is contained in:
Max Kellermann 2020-02-20 09:27:06 +01:00
parent a20dd12117
commit 35d97a24f0

View file

@ -2459,6 +2459,7 @@ Val* AssignExpr::InitVal(const BroType* t, Val* aggr) const
if ( ! v )
return 0;
::Ref(v);
aggr_r->Assign(field, v);
return v;
}