Xapian::TermIterator::operator* returns std::string which is destroyed
as soon as (*i).c_str() finishes. The remembered pointer 'term' then
references invalid memory.
Signed-off-by: Vladimir Marek <vlmarek@volny.cz>
const char *prefix)
{
int prefix_len = strlen (prefix);
const char *prefix)
{
int prefix_len = strlen (prefix);
- const char *term = NULL;
char *value;
i.skip_to (prefix);
char *value;
i.skip_to (prefix);
- if (i != end)
- term = (*i).c_str ();
+ if (i == end)
+ return NULL;
- if (!term || strncmp (term, prefix, prefix_len))
+ std::string term = *i;
+ if (strncmp (term.c_str(), prefix, prefix_len))
- value = talloc_strdup (message, term + prefix_len);
+ value = talloc_strdup (message, term.c_str() + prefix_len);
#if DEBUG_DATABASE_SANITY
i++;
#if DEBUG_DATABASE_SANITY
i++;