From f6875bd32c63a7d2c470c876f63fddc0af9e2d5e Mon Sep 17 00:00:00 2001
From: Gregory Sanders <gsanders87@gmail.com>
Date: Wed, 26 Sep 2018 11:25:04 -0400
Subject: [PATCH] fix use after free in peg-in mempool logic

---
 src/txmempool.cpp | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/txmempool.cpp b/src/txmempool.cpp
index dc7e324d9a..3bf7b27a8e 100644
--- a/src/txmempool.cpp
+++ b/src/txmempool.cpp
@@ -635,14 +635,15 @@ void CTxMemPool::removeForBlock(const std::vector<CTransactionRef>& vtx, unsigne
     for (std::set<std::pair<uint256, COutPoint> >::const_iterator it = setPeginsSpent.begin(); it != setPeginsSpent.end(); it++) {
         std::map<std::pair<uint256, COutPoint>, uint256>::const_iterator it2 = mapWithdrawsSpentToTxid.find(*it);
         if (it2 != mapWithdrawsSpentToTxid.end()) {
-            txiter txit = mapTx.find(it2->second);
+            uint256 tx_id = it2->second;
+            txiter txit = mapTx.find(tx_id);
             assert(txit != mapTx.end());
             const CTransaction& tx = txit->GetTx();
             setEntries stage;
             stage.insert(txit);
             RemoveStaged(stage, true);
             removeRecursive(tx, MemPoolRemovalReason::CONFLICT);
-            ClearPrioritisation(it2->second);
+            ClearPrioritisation(tx_id);
         }
     }
     lastRollingFeeUpdate = GetTime();