From mboxrd@z Thu Jan 1 00:00:00 1970 From: Alcor To: list+catgirl@causal.agency Cc: june@causal.agency Subject: catgirl: [PATCH] Fix use-after-free in windowClose() Date: Sun, 15 Mar 2026 18:04:45 +0100 Message-ID: <87qzpldnwy.fsf@tilde.club> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="=-=-=" --=-=-= Content-Type: text/plain Hi, I found this issue while testing other changes after compiling with -fsanitize=address. The problem should be visible from the diff, I guess. windowShow(swap) seems to access `window' after it is freed (the ASan instrumentation detects this if a /close command is issued in a query or channel window without any argument). Pulling down the windowFree() call after the read usage seems to fix this. Cheers, -Alcor --=-=-= Content-Type: text/x-diff Content-Disposition: attachment; filename=0003-window-Fix-use-after-free-in-windowClose.patch >From 67a06b32b72778ba9d2d5292e350da541ed59781 Mon Sep 17 00:00:00 2001 From: Alcor Date: Sun, 15 Mar 2026 17:44:23 +0100 Subject: [PATCH 3/3] window: Fix use-after-free in windowClose() --- window.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/window.c b/window.c index 2e79a65..3182a47 100644 --- a/window.c +++ b/window.c @@ -478,14 +478,17 @@ void windowClose(uint num) { if (windows[num]->id == Network) return; struct Window *window = windowRemove(num); completeRemove(window->id, NULL); - windowFree(window); if (swap >= num) swap--; if (show == num) { windowShow(swap); + windowFree(window); swap = show; - } else if (show > num) { - show--; - mainUpdate(); + } else { + windowFree(window); + if (show > num) { + show--; + mainUpdate(); + } } statusUpdate(); } -- 2.47.3 --=-=-=--