summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorTomas Janousek <tomi@nomi.cz>2008-02-04 17:33:17 (GMT)
committerTomas Janousek <tomi@nomi.cz>2008-02-04 17:46:24 (GMT)
commitb61502ffbc17d51506bb274472f9bf8934319364 (patch)
treec1f41c75da9563253b3376d2232760684ac0cd3d
parent9671b2f99cf42fcd1d610385836ffc79502d717a (diff)
downloadfluxbox_lack-b61502ffbc17d51506bb274472f9bf8934319364.zip
fluxbox_lack-b61502ffbc17d51506bb274472f9bf8934319364.tar.bz2
Fix a freed memory access in Keys::doAction.
The thing next_key pointed to was getting freed in deleteTree. Signed-off-by: Tomas Janousek <tomi@nomi.cz>
-rw-r--r--src/Keys.cc4
-rw-r--r--src/Keys.hh3
2 files changed, 5 insertions, 2 deletions
diff --git a/src/Keys.cc b/src/Keys.cc
index 7052f55..d85c696 100644
--- a/src/Keys.cc
+++ b/src/Keys.cc
@@ -168,7 +168,7 @@ Keys::t_key::~t_key() {
168 168
169 169
170 170
171Keys::Keys() { } 171Keys::Keys() : next_key(0) { }
172 172
173Keys::~Keys() { 173Keys::~Keys() {
174 ungrabKeys(); 174 ungrabKeys();
@@ -181,6 +181,7 @@ void Keys::deleteTree() {
181 for (keyspace_t::iterator map_it = m_map.begin(); map_it != m_map.end(); ++map_it) 181 for (keyspace_t::iterator map_it = m_map.begin(); map_it != m_map.end(); ++map_it)
182 delete map_it->second; 182 delete map_it->second;
183 m_map.clear(); 183 m_map.clear();
184 next_key = 0;
184} 185}
185 186
186// keys are only grabbed in global context 187// keys are only grabbed in global context
@@ -502,7 +503,6 @@ bool Keys::doAction(int type, unsigned int mods, unsigned int key,
502 isdouble = double_click; 503 isdouble = double_click;
503 } 504 }
504 505
505 static t_key* next_key = m_keylist;
506 if (!next_key) 506 if (!next_key)
507 next_key = m_keylist; 507 next_key = m_keylist;
508 508
diff --git a/src/Keys.hh b/src/Keys.hh
index 399853c..439ecac 100644
--- a/src/Keys.hh
+++ b/src/Keys.hh
@@ -113,6 +113,9 @@ private:
113 t_key *m_keylist; 113 t_key *m_keylist;
114 keyspace_t m_map; 114 keyspace_t m_map;
115 115
116 // former doAction static var, we need to access it from deleteTree
117 t_key *next_key;
118
116 WindowMap m_window_map; 119 WindowMap m_window_map;
117 HandlerMap m_handler_map; 120 HandlerMap m_handler_map;
118}; 121};