Description: Fix double-free bug
 Under some circumstances, depending on the specific data feeded to
 libxmlb, a memory block can be freed twice during the final tree
 prune, when the nodes with less priority are removed.
 .
 libxmlb (0.3.6-3) jammy; urgency=high
 .
   * Fix double-free bug.

Author: Sergio Costas Rodriguez <sergio.costas@canonical.com>
Applied-Upstream: https://github.com/hughsie/libxmlb/pull/127
Bug-Ubuntu: https://bugs.launchpad.net/snap-store-desktop/+bug/1988440
---
The information above should follow the Patch Tagging Guidelines, please
checkout http://dep.debian.net/deps/dep3/ to learn about the format. Here
are templates for supplementary fields that you might want to add:

Origin: <vendor|upstream|other>, <url of original patch>
Bug: <url in upstream bugtracker>
Bug-Debian: https://bugs.debian.org/<bugnumber>
Bug-Ubuntu: https://launchpad.net/bugs/<bugnumber>
Forwarded: <no|not-needed|url proving that it has been forwarded>
Reviewed-By: <name and email of someone who approved the patch>
Last-Update: 2022-09-06

--- libxmlb-0.3.6.orig/src/xb-builder.c
+++ libxmlb-0.3.6/src/xb-builder.c
@@ -438,7 +438,7 @@ xb_builder_xml_lang_prio_cb (XbBuilderNo
 	for (guint i = 0; i < nodes->len; i++) {
 		XbBuilderNode *bn2 = g_ptr_array_index (nodes, i);
 		if (xb_builder_node_get_priority (bn2) < prio_best)
-			g_ptr_array_add (nodes_to_destroy, bn2);
+			g_ptr_array_add (nodes_to_destroy, g_object_ref(bn2));
 
 		/* never visit this node again */
 		xb_builder_node_set_priority (bn2, -2);
@@ -751,7 +751,7 @@ xb_builder_compile (XbBuilder *self, XbB
 	XbBuilderNodetabHelper nodetab_helper = {
 		.buf = NULL,
 	};
-	g_autoptr(GPtrArray) nodes_to_destroy = g_ptr_array_new ();
+	g_autoptr(GPtrArray) nodes_to_destroy = g_ptr_array_new_with_free_func ((GDestroyNotify) g_object_unref);
 	g_autoptr(GTimer) timer = xb_silo_start_profile (priv->silo);
 	g_autoptr(XbBuilderCompileHelper) helper = NULL;
 
