Files
Seth Hillbrand 145b190904 Fix crash in SCH_RULE_AREA::RemoveItem
FreeDrawList() deletes items in arbitrary order. When a SCH_RULE_AREA
is freed before items it contains, those items' destructors call
RemoveItem() on the freed rule area, causing a use-after-free crash
in unordered_set::erase.

This breaks the bidirectional references in ~SCH_RULE_AREA() so
contained items no longer hold dangling pointers to the destroyed
rule area.

Fixes https://gitlab.com/kicad/code/kicad/-/issues/22822
Fixes https://gitlab.com/kicad/code/kicad/-/issues/22993

(cherry picked from commit 92fe51409e)
2026-03-02 11:52:38 -08:00
..
2025-01-05 20:43:31 -05:00