Merge pull request #919 from ailin-nemui/uafs

Use-after-frees

src/core/modules.c

@@ -288,9 +288,10 @@ void modules_deinit(void)
 	g_hash_table_foreach(stridlookup, (GHFunc) uniq_get_modules, &list);
 
 	while (list != NULL) {
+		void *tmp = list->data;
 		module_uniq_destroy(list->data);
-		g_free(list->data);
 		list = g_slist_remove(list, list->data);
+		g_free(tmp);
 	}
 
 	g_hash_table_destroy(idlookup);

src/core/rawlog.c

@@ -64,9 +64,10 @@ static void rawlog_add(RAWLOG_REC *rawlog, char *str)
 	if (rawlog->nlines < rawlog_lines || rawlog_lines <= 2)
 		rawlog->nlines++;
 	else {
-		g_free(rawlog->lines->data);
+		void *tmp = rawlog->lines->data;
 		rawlog->lines = g_slist_remove(rawlog->lines,
 					       rawlog->lines->data);
+		g_free(tmp);
 	}
 
 	if (rawlog->logging) {

src/core/special-vars.c

@@ -620,8 +620,8 @@ void eval_special_string(const char *cmd, const char *data,
 		/* FIXME: window item would need reference counting as well,
 		   eg. "/EVAL win close;say hello" wouldn't work now.. */
 
-		g_free(ret);
 		commands = g_slist_remove(commands, commands->data);
+		g_free(ret);
 	}
 	g_free(orig);
 }

src/fe-common/core/themes.c

@@ -1424,8 +1424,9 @@ void themes_reload(void)
 	change_theme(settings_get_str("theme"), FALSE);
 
 	while (refs != NULL) {
-		theme_unref(refs->data);
+		void *tmp = refs->data;
 		refs = g_slist_remove(refs, refs->data);
+		theme_unref(tmp);
 	}
 }
 

src/irc/dcc/dcc.c

@@ -57,8 +57,9 @@ void dcc_unregister_type(const char *type)
 
 	pos = gslist_find_string(dcc_types, type);
 	if (pos != NULL) {
-		g_free(pos->data);
-                dcc_types = g_slist_remove(dcc_types, pos->data);
+		void *tmp = pos->data;
+		dcc_types = g_slist_remove(dcc_types, pos->data);
+		g_free(tmp);
 	}
 }