summaryrefslogtreecommitdiff
path: root/textscreen
diff options
context:
space:
mode:
authorSimon Howard2014-10-14 01:26:14 -0400
committerSimon Howard2014-10-14 01:26:14 -0400
commit77d7e984d19f52215bf22df95358ef41dda1e430 (patch)
treebcedfe63e4e4ef25985eb5c2aecb3ec02d300d3f /textscreen
parent63e1c884911f9e3382936f84a388e941b29343e6 (diff)
downloadchocolate-doom-77d7e984d19f52215bf22df95358ef41dda1e430.tar.gz
chocolate-doom-77d7e984d19f52215bf22df95358ef41dda1e430.tar.bz2
chocolate-doom-77d7e984d19f52215bf22df95358ef41dda1e430.zip
textscreen: Fix use-after-free with mouse press.
When propagating mouse button presses to widgets within the window, return from MouseButtonPress() immediately, or we will fall through to additional code that references the window structure. If the handler for the widget we clicked on closes the window, this will have been freed. This fixed #439. Thanks to DuClare for telling me about this.
Diffstat (limited to 'textscreen')
-rw-r--r--textscreen/txt_window.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/textscreen/txt_window.c b/textscreen/txt_window.c
index 1d925beb..7fe83662 100644
--- a/textscreen/txt_window.c
+++ b/textscreen/txt_window.c
@@ -402,6 +402,7 @@ static void MouseButtonPress(txt_window_t *window, int b)
&& y >= widgets->y && y < (signed) (widgets->y + widgets->h))
{
TXT_WidgetMousePress(window, x, y, b);
+ return;
}
// Was one of the action area buttons pressed?
@@ -428,8 +429,7 @@ static void MouseButtonPress(txt_window_t *window, int b)
// Pass through mouse press.
TXT_WidgetMousePress(widget, x, y, b);
-
- break;
+ return;
}
}
}