From 4b2fe2476292db84adc075d4fece8e57177a0e14 Mon Sep 17 00:00:00 2001
From: Thomas Holder <thomas@thomas-holder.de>
Date: Sun, 27 Oct 2019 07:35:34 +0100
Subject: fix heap-use-after-free on "Unlink Clone"

Reverts part of 6e5d89bf9595
---
 src/object/sp-tref.cpp | 2 ++
 1 file changed, 2 insertions(+)

(limited to 'src/object/sp-tref.cpp')

diff --git a/src/object/sp-tref.cpp b/src/object/sp-tref.cpp
index 60ce63639..a99f8686f 100644
--- a/src/object/sp-tref.cpp
+++ b/src/object/sp-tref.cpp
@@ -483,6 +483,7 @@ sp_tref_convert_to_tspan(SPObject *obj)
             new_tspan->updateRepr();
 
             // Hold onto our SPObject and repr for now.
+            sp_object_ref(tref);
             Inkscape::GC::anchor(tref_repr);
 
             // Remove ourselves, not propagating delete events to avoid a
@@ -495,6 +496,7 @@ sp_tref_convert_to_tspan(SPObject *obj)
 
             // Establish the succession and let go of our object.
             tref->setSuccessor(new_tspan);
+            sp_object_unref(tref);
         }
     }
     ////////////////////
-- 
cgit v1.2.3