Re: Possible use after free in fvwm3 [Re: sysutils/rofi sometimes coredumps in __vfprintf (+ similar crash in fvwm3)]

On Sat, 30 Sept 2023 at 11:32, Theo Buehler <tb@theobuehler.org> wrote:

Hey all,

> ===================================================================
> RCS file: patches/patch-fvwm_infostore_c
> diff -N patches/patch-fvwm_infostore_c
> --- /dev/null 1 Jan 1970 00:00:00 -0000
> +++ patches/patch-fvwm_infostore_c 30 Sep 2023 10:16:21 -0000
> @@ -0,0 +1,24 @@
> +Avoid use-after-free caused by LoadGlobalState() freeing the key
> +that was just inserted. Fix this by always copying the key and
> +avoiding a leak in the only other caller of insert_metainfo()

Thanks, Theo. I think you're right -- I've tested this a few times
and it hasn't broken things for me.

I've merged this to 'main' -- if someone wishes to do any testing of
their own, please do.

Kindly,
Thomas