An issue was discovered in the tremor-script crate before 0.11.6 for Rust. A patch operation may result in a use-after-free.

Affected: crates.io: tremor-script

An issue was discovered in the tremor-script crate before 0.11.6 for Rust. A patch operation may result in a use-after-free.

Affected: crates.io: tremor-script

Affected versions of this crate maintains references to memory that might have been freed already. If affects the following two `tremor-script` language constructs:

* A [Merge](https://www.tremor.rs/docs/tremor-script/index#merge) where we assign the result back to the target expression and the expression to be merged needs to reference the `event`:

``` let state = merge state of event end; ```

* A [Patch](https://www.tremor.rs/docs/tremor-script/index#patch) where we assign the result back to the target expression and the patch operations used need to reference the `event`:

``` let state = patch state of insert event.key => event.value end; ```

For constructs like this (it doesnt matter what is references in the expression to be merged or the patch operations) an optimization was applied to manipulate the target value in-place, instead of cloning it.

Our `Value` struct which underpins all event data in `tremor-script`, is representing as borrowed strings `beef::Cow<'lifetime, str>` that reference the actual `Vec<u8>` the event is based upon. We keep the raw byte-array next to the event structure inside our `Event` struct as a self-referential struct, so we make sure that the structured `Value` and its references are valid across its whole lifetime.

The optimization was considered safe as long as it was only possible to merge or patche `event` data or static data. When `state` was introduced to `tremor-script` a new possibility existed, to keep `Value` data aroun…