From 55769ca9f03e959f7ddfaec224690fb062f48da1 Mon Sep 17 00:00:00 2001
From: Crissman Loomis <github@cloom.is>
Date: Fri, 11 Sep 2026 10:02:18 -0400
Subject: [PATCH] fix Qt use-after-free reading the player name

Closes #1673
---
 win/Qt/qt_plsel.cpp | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/win/Qt/qt_plsel.cpp b/win/Qt/qt_plsel.cpp
index a280f07fc..baaf49f6f 100644
--- a/win/Qt/qt_plsel.cpp
+++ b/win/Qt/qt_plsel.cpp
@@ -559,7 +559,10 @@ void NetHackQtPlayerSelector::plnamePlayVsQuit()
 // the line edit widget for the name field has received input
 void NetHackQtPlayerSelector::selectName(const QString& n)
 {
-    const char *name_str = n.toLatin1().constData();
+    // the QByteArray has to outlive name_str; calling constData() on
+    // the temporary returned by toLatin1() leaves it dangling
+    QByteArray name_bytes = n.toLatin1();
+    const char *name_str = name_bytes.constData();
     // skip any leading spaces
     // (it would be better to set up a validator that rejects leading spaces)
     while (*name_str == ' ')