xcb_ewmh_get_wm_name_reply frees the reply on return leading a double free if it's again wiped

This commit is contained in:
Andrei Barbu 2016-06-04 16:52:56 -04:00
parent c7881b2a34
commit 5d6b388a49

View file

@ -409,12 +409,14 @@ inline void ya_get_cur_window_title(ya_block_t * blk) {
xcb_get_property_cookie_t wm_ck, wmvis_ck;
wm_ck = xcb_ewmh_get_wm_name(ya.ewmh, ya.curwin);
wmvis_ck = xcb_ewmh_get_wm_visible_name(ya.ewmh, ya.curwin);
if (xcb_ewmh_get_wm_name_reply(ya.ewmh, wm_ck, &reply, NULL) == 1 || xcb_ewmh_get_wm_visible_name_reply(ya.ewmh, wmvis_ck, &reply, NULL) == 1) {
int len = GET_MIN(blk->bufsize, reply.strings_len);
strncpy(blk->buf, reply.strings, len);
blk->buf[len]='\0';
}
xcb_ewmh_get_utf8_strings_reply_wipe(&reply);
if (xcb_ewmh_get_wm_name_reply(ya.ewmh, wm_ck, &reply, NULL) == 1) {
if (xcb_ewmh_get_wm_visible_name_reply(ya.ewmh, wmvis_ck, &reply, NULL) == 1) {
int len = GET_MIN(blk->bufsize, reply.strings_len);
strncpy(blk->buf, reply.strings, len);
blk->buf[len]='\0';
}
xcb_ewmh_get_utf8_strings_reply_wipe(&reply);
}
}
}