git: 9front

Download patch

ref: c3f43429d062848146c8a34447a4f142cfbece47
parent: cdaa7b899f874f4e0e6c8a04dcf6a5a3a7dfafdf
author: cinap_lenrek <cinap_lenrek@gmx.de>
date: Thu Oct 18 14:51:32 EDT 2012

rio: copy window labels for menu3

as the menu is displayed, the window might go away or change its
label causing menuhit() to dereference bad memory. just strdup()
the labels before passing to menu3str to prevent accidents.

--- a/sys/src/cmd/rio/rio.c
+++ b/sys/src/cmd/rio/rio.c
@@ -709,10 +709,14 @@
 	}
 	if(n >= nelem(menu3str)-Hidden)
 		n = nelem(menu3str)-Hidden-1;
-	for(i=0; i<n; i++)
-		menu3str[i+Hidden] = hidden[i]->label;
-	menu3str[i+Hidden] = nil;
-
+	for(i=0; i<n; i++){
+		free(menu3str[i+Hidden]);
+		menu3str[i+Hidden] = estrdup(hidden[i]->label);
+	}
+	for(i+=Hidden; menu3str[i]; i++){
+		free(menu3str[i]);
+		menu3str[i] = nil;
+	}
 	sweeping = 1;
 	switch(i = menuhit(3, mousectl, &menu3, wscreen)){
 	case -1:
--