Integer overflow, use-after-free.
vulners.com/securityvulns/securityvulns:doc:26165
vulners.com/securityvulns/securityvulns:doc:26166
vulners.com/securityvulns/securityvulns:doc:26167
vulners.com/securityvulns/securityvulns:doc:26168
vulners.com/securityvulns/securityvulns:doc:26189
vulners.com/securityvulns/securityvulns:doc:26190
vulners.com/securityvulns/securityvulns:doc:26204