From e77d7577a25b5eb5c6bc79a9ce0ea335a4df6508 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kristian=20H=C3=B8gsberg?= Date: Tue, 30 Oct 2012 18:10:30 -0400 Subject: window: Fix use-after-free in menu button handler Commit d2fbb3870cfaea623a87ba28c9587676bbdc93f7 introduced a use-after-free error in the case where we destroy the menu. --- clients/window.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/clients/window.c b/clients/window.c index d5a14dd0..fe968ed5 100644 --- a/clients/window.c +++ b/clients/window.c @@ -3363,10 +3363,9 @@ menu_button_handler(struct widget *widget, menu->current, menu->window->parent->user_data); input_ungrab(input); menu_destroy(menu); - } - - if (state == WL_POINTER_BUTTON_STATE_RELEASED) + } else if (state == WL_POINTER_BUTTON_STATE_RELEASED) { menu->release_count++; + } } static void -- cgit v1.2.1