From d8b7b7278987462791488f756edd26842d059074 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Samuel=20R=C3=B8dal?= <sroedal@trolltech.com>
Date: Fri, 11 Dec 2009 14:23:34 +0100
Subject: Fixed invalid read in QCache::unlink after recent change.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We need to store a pointer to the object in order to delete it later,
since the node containing the pointer will be deleted when removing it
from the hash.

Reviewed-by: Jan-Arve Sæther
---
 src/corelib/tools/qcache.h | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/corelib/tools/qcache.h b/src/corelib/tools/qcache.h
index ee9523f..086a52f 100644
--- a/src/corelib/tools/qcache.h
+++ b/src/corelib/tools/qcache.h
@@ -70,8 +70,9 @@ class QCache
         if (l == &n) l = n.p;
         if (f == &n) f = n.n;
         total -= n.c;
+        T *object = n.t;
         hash.remove(*n.keyPtr);
-        delete n.t;
+        delete object;
     }
     inline T *relink(const Key &key) {
         typename QHash<Key, Node>::iterator i = hash.find(key);
-- 
cgit v0.12