summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJohn-Mark Bell <jmb@netsurf-browser.org>2019-12-22 11:13:12 +0000
committerVincent Sanders <vince@kyllikki.org>2019-12-22 11:13:12 +0000
commitfb4f1d28ba4d2b0935ac56a3d37ea9fa52c5de51 (patch)
tree8908b3ed8f6dac5261616c55721ab47b8f586466
parent55ba27c68f1664e8a6a356e45c6c9ce9c7bdded9 (diff)
downloadnetsurf-fb4f1d28ba4d2b0935ac56a3d37ea9fa52c5de51.tar.gz
netsurf-fb4f1d28ba4d2b0935ac56a3d37ea9fa52c5de51.tar.bz2
fix parent pointer use after free in RISC OS dialog handling
-rw-r--r--frontends/riscos/dialog.c6
1 files changed, 5 insertions, 1 deletions
diff --git a/frontends/riscos/dialog.c b/frontends/riscos/dialog.c
index 8a907eb24..f0bcb5940 100644
--- a/frontends/riscos/dialog.c
+++ b/frontends/riscos/dialog.c
@@ -335,12 +335,16 @@ void ro_gui_dialog_close(wimp_w close)
{
int i;
wimp_caret caret;
+ wimp_w parent = -1;
os_error *error;
/* Check if we're a persistent window */
for (i = 0; i < MAX_PERSISTENT; i++) {
if (persistent_dialog[i].dialog == close) {
/* We are => invalidate record */
+ if (persistent_dialog[i].parent != NULL) {
+ parent = persistent_dialog[i].parent;
+ }
persistent_dialog[i].parent = NULL;
persistent_dialog[i].dialog = NULL;
break;
@@ -363,7 +367,7 @@ void ro_gui_dialog_close(wimp_w close)
/* Check if we are a persistent window */
if (i < MAX_PERSISTENT) {
error = xwimp_set_caret_position(
- persistent_dialog[i].parent,
+ parent,
wimp_ICON_WINDOW, -100, -100,
32, -1);
/* parent may have been closed first */