From b21fb9f84096d9927780b86fa90629a096af358d Mon Sep 17 00:00:00 2001 From: Gleb Mazovetskiy Date: Mon, 3 Dec 2018 21:23:53 +0000 Subject: [PATCH] Fix #2782: heap-use-after-free in expand.cpp Selector stack got popped during eval, resulting in `extender` deletion. --- src/expand.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/expand.cpp b/src/expand.cpp index dd16f75d5..40cc41610 100644 --- a/src/expand.cpp +++ b/src/expand.cpp @@ -640,7 +640,7 @@ namespace Sass { Statement* Expand::operator()(Extension_Ptr e) { - if (Selector_List_Ptr extender = selector()) { + if (Selector_List_Obj extender = selector()) { Selector_List_Ptr sl = e->selector(); // abort on invalid selector if (sl == NULL) return NULL;