From 00e422fe1ebf617933bf7ae06e462a5332182d94 Mon Sep 17 00:00:00 2001
From: Karol Kosek <krkk@serenityos.org>
Date: Tue, 5 Dec 2023 18:14:41 +0100
Subject: [PATCH] LibAudio: Fix use-after-free in write_vorbis_comment

---
 Userland/Libraries/LibAudio/VorbisComment.cpp | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/Userland/Libraries/LibAudio/VorbisComment.cpp b/Userland/Libraries/LibAudio/VorbisComment.cpp
index 4ecc1ca735..74e58f8af9 100644
--- a/Userland/Libraries/LibAudio/VorbisComment.cpp
+++ b/Userland/Libraries/LibAudio/VorbisComment.cpp
@@ -178,9 +178,9 @@ ErrorOr<void> write_vorbis_comment(Metadata const& metadata, Stream& target)
     auto vorbis_user_comments = TRY(make_vorbis_user_comments(metadata));
     TRY(target.write_value<LittleEndian<u32>>(vorbis_user_comments.size()));
     for (auto const& field : vorbis_user_comments) {
-        auto const serialized_field = TRY(String::formatted("{}={}", field.field_name, field.contents)).bytes();
-        TRY(target.write_value<LittleEndian<u32>>(serialized_field.size()));
-        TRY(target.write_until_depleted(serialized_field));
+        auto const serialized_field = TRY(String::formatted("{}={}", field.field_name, field.contents));
+        TRY(target.write_value<LittleEndian<u32>>(serialized_field.bytes().size()));
+        TRY(target.write_until_depleted(serialized_field.bytes()));
     }
 
     return {};