From 77d7e984d19f52215bf22df95358ef41dda1e430 Mon Sep 17 00:00:00 2001
From: Simon Howard
Date: Tue, 14 Oct 2014 01:26:14 -0400
Subject: textscreen: Fix use-after-free with mouse press.

When propagating mouse button presses to widgets within the window,
return from MouseButtonPress() immediately, or we will fall through
to additional code that references the window structure. If the
handler for the widget we clicked on closes the window, this will
have been freed.

This fixed #439. Thanks to DuClare for telling me about this.
---
 textscreen/txt_window.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'textscreen')

diff --git a/textscreen/txt_window.c b/textscreen/txt_window.c
index 1d925beb..7fe83662 100644
--- a/textscreen/txt_window.c
+++ b/textscreen/txt_window.c
@@ -402,6 +402,7 @@ static void MouseButtonPress(txt_window_t *window, int b)
      && y >= widgets->y && y < (signed) (widgets->y + widgets->h))
     {
         TXT_WidgetMousePress(window, x, y, b);
+        return;
     }
 
     // Was one of the action area buttons pressed?
@@ -428,8 +429,7 @@ static void MouseButtonPress(txt_window_t *window, int b)
             // Pass through mouse press.
 
             TXT_WidgetMousePress(widget, x, y, b);
-
-            break;
+            return;
         }
     }
 }
-- 
cgit v1.2.3