From: Paul Eggert <eggert@cs.ucla.edu>
Date: Wed, 13 May 2015 06:44:39 +0000 (-0700)
Subject: * src/editfns.c (Fformat): Fix use-after-free bug (Bug#20548).
X-Git-Tag: emacs-25.0.90~2106
X-Git-Url: http://git.eshelyaron.com/gitweb/?a=commitdiff_plain;h=a314016775858612d0c79e24f71b1698d6784ad6;p=emacs.git

* src/editfns.c (Fformat): Fix use-after-free bug (Bug#20548).
---

diff --git a/src/editfns.c b/src/editfns.c
index 1686fbf668b..cddb0d4eae6 100644
--- a/src/editfns.c
+++ b/src/editfns.c
@@ -4390,9 +4390,6 @@ usage: (format STRING &rest OBJECTS)  */)
     nchars = multibyte_chars_in_text ((unsigned char *) buf, p - buf);
   val = make_specified_string (buf, nchars, p - buf, multibyte);
 
-  /* If we allocated BUF with malloc, free it too.  */
-  SAFE_FREE ();
-
   /* If the format string has text properties, or any of the string
      arguments has text properties, set up text properties of the
      result string.  */
@@ -4498,6 +4495,9 @@ usage: (format STRING &rest OBJECTS)  */)
       UNGCPRO;
     }
 
+  /* If we allocated BUF or INFO with malloc, free it too.  */
+  SAFE_FREE ();
+
   return val;
 }