summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorSimon Howard2014-10-14 01:26:14 -0400
committerSimon Howard2014-10-14 01:26:14 -0400
commit77d7e984d19f52215bf22df95358ef41dda1e430 (patch)
treebcedfe63e4e4ef25985eb5c2aecb3ec02d300d3f
parent63e1c884911f9e3382936f84a388e941b29343e6 (diff)
downloadchocolate-doom-77d7e984d19f52215bf22df95358ef41dda1e430.tar.gz
chocolate-doom-77d7e984d19f52215bf22df95358ef41dda1e430.tar.bz2
chocolate-doom-77d7e984d19f52215bf22df95358ef41dda1e430.zip
textscreen: Fix use-after-free with mouse press.
When propagating mouse button presses to widgets within the window, return from MouseButtonPress() immediately, or we will fall through to additional code that references the window structure. If the handler for the widget we clicked on closes the window, this will have been freed. This fixed #439. Thanks to DuClare for telling me about this.
-rw-r--r--textscreen/txt_window.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/textscreen/txt_window.c b/textscreen/txt_window.c
index 1d925beb..7fe83662 100644
--- a/textscreen/txt_window.c
+++ b/textscreen/txt_window.c
@@ -402,6 +402,7 @@ static void MouseButtonPress(txt_window_t *window, int b)
&& y >= widgets->y && y < (signed) (widgets->y + widgets->h))
{
TXT_WidgetMousePress(window, x, y, b);
+ return;
}
// Was one of the action area buttons pressed?
@@ -428,8 +429,7 @@ static void MouseButtonPress(txt_window_t *window, int b)
// Pass through mouse press.
TXT_WidgetMousePress(widget, x, y, b);
-
- break;
+ return;
}
}
}