URL: <https://savannah.gnu.org/bugs/?68657>
Summary: fix use-after-free when walking linked list
Group: GNU Screen
Submitter: trux
Submitted: Fri 28 Aug 2026 10:05:18 AM PDT
Category: Crash/Freeze/Infloop
Severity: 3 - Normal
Priority: 5 - Normal
Status: None
Privacy: Public
Assigned to: None
Open/Closed: Open
Discussion Lock: Unlocked
Release: 5.0.2
Fixed Release: None
Planned Release: None
Work Required: None
_______________________________________________________
Follow-up Comments:
-------------------------------------------------------
Date: Fri 28 Aug 2026 10:05:18 AM PDT By: Truxton Fulton <trux>
Built with -fsanitize=address, 5.0.2 reports a heap-use-after-free on quit
with two displays attached to one window. The problem is in
window.c:FreeWindow in the loop that walks the canvas linked list and sets
canvas->c_lnext = NULL. We need to keep track of canvas->c_lnext before
clobbering it with NULL. Attached is a 1-line patch.
_______________________________________________________
File Attachments:
Name: upstream-freewindow-uaf.patch Size: 1.2KiB
<https://file.savannah.gnu.org/file/upstream-freewindow-uaf.patch?file_id=58925>
AGPL NOTICE
These attachments are served by Savane. You can download the corresponding
source code of Savane at
https://savannah.gnu.org/source/savane-dfaf8a9487ea4c658df0ce641e87357250b26bfd.tar.gz
_______________________________________________________
Reply to this item at:
<https://savannah.gnu.org/bugs/?68657>
_______________________________________________
Message sent via Savannah
https://savannah.gnu.org/
signature.asc
Description: PGP signature
