From 436aa8a4e4258fcd19f2ec0018ac55930c78c755 Mon Sep 17 00:00:00 2001
From: Ulf Hermann <ulf.hermann@qt.io>
Date: Fri, 17 Apr 2020 15:27:41 +0200
Subject: [PATCH] QMultiHash: Retrieve the value before deleting on take()

Otherwise we may perform a use-after-free.

Change-Id: I58080dfc8bb6ef9a86f2118407a05db8ae1ecfbd
Reviewed-by: Simon Hausmann <simon.hausmann@qt.io>
Reviewed-by: Lars Knoll <lars.knoll@qt.io>
---
 src/corelib/tools/qhash.h | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/src/corelib/tools/qhash.h b/src/corelib/tools/qhash.h
index 3bbf8a5a48..2c39a9dfc8 100644
--- a/src/corelib/tools/qhash.h
+++ b/src/corelib/tools/qhash.h
@@ -1320,14 +1320,16 @@ public:
             return T();
         Chain *e = it.node()->value;
         Q_ASSERT(e);
-        if (!e->next)
-            d->erase(it);
-        else
+        T t = std::move(e->value);
+        if (e->next) {
             it.node()->value = e->next;
+            delete e;
+        } else {
+            // erase() deletes the values.
+            d->erase(it);
+        }
         --m_size;
         Q_ASSERT(m_size >= 0);
-        T t = std::move(e->value);
-        delete e;
         return t;
     }