shithub: choc

Download patch

ref: 77d7e984d19f52215bf22df95358ef41dda1e430
parent: 63e1c884911f9e3382936f84a388e941b29343e6
author: Simon Howard <[email protected]>
date: Mon Oct 13 21:26:14 EDT 2014

textscreen: Fix use-after-free with mouse press.

When propagating mouse button presses to widgets within the window,
return from MouseButtonPress() immediately, or we will fall through
to additional code that references the window structure. If the
handler for the widget we clicked on closes the window, this will
have been freed.

This fixed #439. Thanks to DuClare for telling me about this.

--- a/textscreen/txt_window.c

+++ b/textscreen/txt_window.c

@@ -402,6 +402,7 @@

      && y >= widgets->y && y < (signed) (widgets->y + widgets->h))

     {

         TXT_WidgetMousePress(window, x, y, b);

+        return;

     }

     // Was one of the action area buttons pressed?

@@ -428,8 +429,7 @@

             // Pass through mouse press.

             TXT_WidgetMousePress(widget, x, y, b);

-

-            break;

+            return;

         }

     }

 }