From 0beb148b6a97dcfb2f3fd0280a87b747078adb97 Mon Sep 17 00:00:00 2001
From: Alexandre Duret-Lutz <adl@lrde.epita.fr>
Date: Sun, 23 Nov 2014 21:45:20 +0100
Subject: [PATCH] * src/tgbaalgos/closure.cc: Fix invalid read.

---
 src/tgbaalgos/closure.cc | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/src/tgbaalgos/closure.cc b/src/tgbaalgos/closure.cc
index ee03c4644..65df7e595 100644
--- a/src/tgbaalgos/closure.cc
+++ b/src/tgbaalgos/closure.cc
@@ -71,9 +71,11 @@ namespace spot
                       }
                     if (need_new_trans)
                       {
-                        unsigned i =
-                          a->new_transition(state, t2.dst, cond, acc);
-                        dst2trans[t2.dst].push_back(i);
+			// Load t2.dst first, because t2 can be
+			// invalidated by new_transition().
+			auto dst = t2.dst;
+                        auto i = a->new_transition(state, dst, cond, acc);
+                        dst2trans[dst].push_back(i);
                         todo.push_back(i);
                       }
 		  }