From f3d43d9137b0d1f126e701b2da5d9ddd37073709 Mon Sep 17 00:00:00 2001 From: Timo Sirainen Date: Mon, 30 Dec 2002 23:10:57 +0000 Subject: [PATCH] Don't access free'd memory. git-svn-id: http://svn.irssi.org/repos/irssi/trunk@3087 dbcabf3a-b0e7-0310-adc4-f8d773084564 --- src/fe-text/textbuffer.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/src/fe-text/textbuffer.c b/src/fe-text/textbuffer.c index 5a8d256d..930e55ad 100644 --- a/src/fe-text/textbuffer.c +++ b/src/fe-text/textbuffer.c @@ -113,15 +113,16 @@ static void text_chunk_line_free(TEXT_BUFFER_REC *buffer, LINE_REC *line) { TEXT_CHUNK_REC *chunk; const unsigned char *text; - unsigned char *tmp = NULL; + unsigned char cmd, *tmp = NULL; for (text = line->text;; text++) { if (*text != '\0') continue; text++; - if (*text == LINE_CMD_CONTINUE || *text == LINE_CMD_EOL) { - if (*text == LINE_CMD_CONTINUE) + cmd = *text; + if (cmd == LINE_CMD_CONTINUE || cmd == LINE_CMD_EOL) { + if (cmd == LINE_CMD_CONTINUE) memcpy(&tmp, text+1, sizeof(char *)); /* free the previous block */ @@ -133,11 +134,11 @@ static void text_chunk_line_free(TEXT_BUFFER_REC *buffer, LINE_REC *line) text_chunk_destroy(buffer, chunk); } - if (*text == LINE_CMD_EOL) + if (cmd == LINE_CMD_EOL) break; text = tmp-1; - } else if (*text == LINE_CMD_INDENT_FUNC) { + } else if (cmd == LINE_CMD_INDENT_FUNC) { text += sizeof(int (*) ()); } }