QMultiHash: Retrieve the value before deleting on take()

Otherwise we may perform a use-after-free.

Change-Id: I58080dfc8bb6ef9a86f2118407a05db8ae1ecfbd
Reviewed-by: Simon Hausmann <simon.hausmann@qt.io>
Reviewed-by: Lars Knoll <lars.knoll@qt.io>

1 files changed, 7 insertions, 5 deletions

diff --git a/src/corelib/tools/qhash.h b/src/corelib/tools/qhash.h
index 3bbf8a5a48..2c39a9dfc8 100644
--- a/src/corelib/tools/qhash.h
+++ b/src/corelib/tools/qhash.h
@@ -1320,14 +1320,16 @@ public:
             return T();
         Chain *e = it.node()->value;
         Q_ASSERT(e);
-        if (!e->next)
-            d->erase(it);
-        else
+        T t = std::move(e->value);
+        if (e->next) {
             it.node()->value = e->next;
+            delete e;
+        } else {
+            // erase() deletes the values.
+            d->erase(it);
+        }
         --m_size;
         Q_ASSERT(m_size >= 0);
-        T t = std::move(e->value);
-        delete e;
         return t;
     }