Re: Possible use after free in fvwm3 [Re: sysutils/rofi sometimes coredumps in __vfprintf (+ similar crash in fvwm3)]

On Sat, Sep 30, 2023 at 11:43:10AM +0100, Thomas Adam wrote:
> On Sat, 30 Sept 2023 at 11:32, Theo Buehler <tb@theobuehler.org> wrote:
>
> Hey all,
>
> > ===================================================================
> > RCS file: patches/patch-fvwm_infostore_c
> > diff -N patches/patch-fvwm_infostore_c
> > --- /dev/null 1 Jan 1970 00:00:00 -0000
> > +++ patches/patch-fvwm_infostore_c 30 Sep 2023 10:16:21 -0000
> > @@ -0,0 +1,24 @@
> > +Avoid use-after-free caused by LoadGlobalState() freeing the key
> > +that was just inserted. Fix this by always copying the key and
> > +avoiding a leak in the only other caller of insert_metainfo()
>
> Thanks, Theo. I think you're right -- I've tested this a few times
> and it hasn't broken things for me.
>
> I've merged this to 'main' -- if someone wishes to do any testing of
> their own, please do.

Great. I've committed this to the port, so fvwm3-1.0.8p0 should fix it.