* src/editfns.c (Fformat): Fix use-after-free bug (Bug#20548).

diff --git a/src/editfns.c b/src/editfns.c
index 1686fbf668b9226eb63d3ee60569d4dadfdf24b8..cddb0d4eae679272f5253ea496c6b3b084ef98c5 100644 (file)
--- a/src/editfns.c
+++ b/src/editfns.c
@@ -4390,9 +4390,6 @@ usage: (format STRING &rest OBJECTS)  */)
     nchars = multibyte_chars_in_text ((unsigned char *) buf, p - buf);
   val = make_specified_string (buf, nchars, p - buf, multibyte);
 
-  /* If we allocated BUF with malloc, free it too.  */
-  SAFE_FREE ();
-
   /* If the format string has text properties, or any of the string
      arguments has text properties, set up text properties of the
      result string.  */
@@ -4498,6 +4495,9 @@ usage: (format STRING &rest OBJECTS)  */)
       UNGCPRO;
     }
 
+  /* If we allocated BUF or INFO with malloc, free it too.  */
+  SAFE_FREE ();
+
   return val;
 }