Details
Description
In DOMDocumentTypeImpl::setOwnerDocument() (DOMDocumentTypeImpl.cpp line 232)
the systemid member variable is clobbered by the value of internalSubset due to
a typo when the code was duped from the paragraph above it.
temp = (XMLCh*) internalSubset; // cast off const
systemId = docImpl->cloneString(internalSubset);
delete [] temp;
should be
temp = (XMLCh*) internalSubset; // cast off const
internalSubset = docImpl->cloneString(internalSubset);
delete [] temp;