Subject: catgirl: [PATCH] Fix use-after-free in windowClose()

From: Alcor <[email-masked]>
Date: Sun, 15 Mar 2026 18:04:45 +0100

Hi,

I found this issue while testing other changes after compiling with
-fsanitize=address.

The problem should be visible from the diff, I guess. windowShow(swap)
seems to access `window' after it is freed (the ASan instrumentation
detects this if a /close command is issued in a query or channel window
without any argument).

Pulling down the windowFree() call after the read usage seems to fix
this.

Cheers,
-Alcor

>From 67a06b32b72778ba9d2d5292e350da541ed59781 Mon Sep 17 00:00:00 2001
From: Alcor <[email-masked]>
Date: Sun, 15 Mar 2026 17:44:23 +0100
Subject: [PATCH 3/3] window: Fix use-after-free in windowClose()

---
 window.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/window.c b/window.c
index 2e79a65..3182a47 100644
--- a/window.c
+++ b/window.c
@@ -478,14 +478,17 @@ void windowClose(uint num) {
 	if (windows[num]->id == Network) return;
 	struct Window *window = windowRemove(num);
 	completeRemove(window->id, NULL);
-	windowFree(window);
 	if (swap >= num) swap--;
 	if (show == num) {
 		windowShow(swap);
+		windowFree(window);
 		swap = show;
-	} else if (show > num) {
-		show--;
-		mainUpdate();
+	} else {
+		windowFree(window);
+		if (show > num) {
+			show--;
+			mainUpdate();
+		}
 	}
 	statusUpdate();
 }
-- 
2.47.3