Also fixed:

tinydict.cpp: Memory allocated by 'new[]' should be deallocated by 'delete[]', not 'delete'.
lvtinydom.cpp: Use-after-free.

Author: virxkane

crengine/src/lvtinydom.cpp

@@ -11313,8 +11313,8 @@ ldomNode * ldomNode::persist()
         } else {
             // TEXT->PTEXT
             lString8 utf8 = _data._text_ptr->getText();
-            delete _data._text_ptr;
             lUInt32 parentIndex = _data._text_ptr->getParentIndex();
+            delete _data._text_ptr;
             _handle._dataIndex = (_handle._dataIndex & ~0xF) | NT_PTEXT;
             _data._ptext_addr = getDocument()->_textStorage.allocText(_handle._dataIndex, parentIndex, utf8 );
             // change type

tinydict/tinydict.cpp

@@ -606,7 +606,7 @@ TinyDictZStream::~TinyDictZStream()
     if ( chunks )
         delete [] chunks;
     if ( offsets )
-        delete offsets;
+        delete [] offsets;
 }
 
 bool TinyDictZStream::open( FILE * file )