Fix a freed memory access in Keys::doAction.

The thing next_key pointed to was getting freed in deleteTree.

Signed-off-by: Tomas Janousek <tomi@nomi.cz>

2 files changed, 5 insertions, 2 deletions

diff --git a/src/Keys.cc b/src/Keys.cc
index 7052f55..d85c696 100644
--- a/src/Keys.cc
+++ b/src/Keys.cc
@@ -168,7 +168,7 @@ Keys::t_key::~t_key() {
 
 
 
-Keys::Keys() { }
+Keys::Keys() : next_key(0) { }
 
 Keys::~Keys() {
     ungrabKeys();
@@ -181,6 +181,7 @@ void Keys::deleteTree() {
     for (keyspace_t::iterator map_it = m_map.begin(); map_it != m_map.end(); ++map_it)
         delete map_it->second;
     m_map.clear();
+    next_key = 0;
 }
 
 // keys are only grabbed in global context
@@ -502,7 +503,6 @@ bool Keys::doAction(int type, unsigned int mods, unsigned int key,
         isdouble = double_click;
     }
 
-    static t_key* next_key = m_keylist;
     if (!next_key)
         next_key = m_keylist;
 
diff --git a/src/Keys.hh b/src/Keys.hh
index 399853c..439ecac 100644
--- a/src/Keys.hh
+++ b/src/Keys.hh
@@ -113,6 +113,9 @@ private:
     t_key *m_keylist;
     keyspace_t m_map;
 
+    // former doAction static var, we need to access it from deleteTree
+    t_key *next_key;
+
     WindowMap m_window_map;
     HandlerMap m_handler_map;
 };