use-after-free in validate_intro_point_failure
In validate_intro_point_failure(), we look at identity
after freeing intro
. But identity
is a reference into intro
, so we shouldn't free intro
till we're done with it.
In validate_intro_point_failure(), we look at identity
after freeing intro
. But identity
is a reference into intro
, so we shouldn't free intro
till we're done with it.