rgw: Fix use after free in IAM policy parser

Signed-off-by: Adam C. Emerson <aemerson@redhat.com>
(cherry picked from commit 8377ba6525de5ebfe33a7dda14f17d96e8ac4ef4)

diff --git a/src/rgw/rgw_iam_policy.cc b/src/rgw/rgw_iam_policy.cc
index 9320fd50d779f32487eacd5ffbd976a93a0ecb5c..309b3bab5a36e742abdbbad34fcde4462c9d8cd5 100644 (file)
--- a/src/rgw/rgw_iam_policy.cc
+++ b/src/rgw/rgw_iam_policy.cc
@@ -688,9 +688,10 @@ bool ParseState::key(const char* s, size_t l) {
 
   if (!k) {
     if (w->kind == TokenKind::cond_op) {
+      auto id = w->id;
       auto& t = pp->policy.statements.back();
       pp->s.emplace_back(pp, cond_key);
-      t.conditions.emplace_back(w->id, s, l, cond_ifexists);
+      t.conditions.emplace_back(id, s, l, cond_ifexists);
       return true;
     } else {
       return false;