From 762315c47cd539dc5a7288803ad4d6dd613e17b8 Mon Sep 17 00:00:00 2001 From: rubidium Date: Sun, 4 May 2008 21:36:37 +0000 Subject: (svn r12942) -Fix [FS#1979]: closing some windows caused recursion in the Window deletion causing the reading invalid/freed data which could cause crashes. --- src/window.cpp | 30 ++++++++++++++++-------------- 1 file changed, 16 insertions(+), 14 deletions(-) (limited to 'src/window.cpp') diff --git a/src/window.cpp b/src/window.cpp index daceb5406..597542275 100644 --- a/src/window.cpp +++ b/src/window.cpp @@ -416,35 +416,37 @@ void DeleteWindow(Window *w) { if (w == NULL) return; - /* Delete any children a window might have in a head-recursive manner */ - Window *v = FindChildWindow(w); - if (v != NULL) DeleteWindow(v); - if (_thd.place_mode != VHM_NONE && _thd.window_class == w->window_class && _thd.window_number == w->window_number) { ResetObjectToPlace(); } - CallWindowEventNP(w, WE_DESTROY); - if (w->viewport != NULL) DeleteWindowViewport(w); - - SetWindowDirty(w); - free(w->widget); - w->widget = NULL; - w->widget_count = 0; - w->parent = NULL; - /* Prevent Mouseover() from resetting mouse-over coordinates on a non-existing window */ if (_mouseover_last_w == w) _mouseover_last_w = NULL; /* Find the window in the z-array, and effectively remove it - * by moving all windows after it one to the left */ + * by moving all windows after it one to the left. This must be + * done before removing the child so we cannot cause recursion + * between the deletion of the parent and the child. */ Window **wz = FindWindowZPosition(w); if (wz == NULL) return; memmove(wz, wz + 1, (byte*)_last_z_window - (byte*)wz); _last_z_window--; + /* Delete any children a window might have in a head-recursive manner */ + Window *v = FindChildWindow(w); + if (v != NULL) DeleteWindow(v); + + CallWindowEventNP(w, WE_DESTROY); + if (w->viewport != NULL) DeleteWindowViewport(w); + + SetWindowDirty(w); + free(w->widget); + w->widget = NULL; + w->widget_count = 0; + w->parent = NULL; + delete w; } -- cgit v1.2.3-54-g00ecf