[3.11] gh-120384: gh-120298: Fix array-out-of-bounds & use after free list

[3.11] gh-120384: gh-120298: Fix array-out-of-bounds & use after free list #214055