Changeset c3a47c9

Timestamp:

Jan 30, 2010, 9:26:54 PM (14 years ago)

Author:

Anders Kaseorg <andersk@mit.edu>

Branches:

master, release-1.10, release-1.6, release-1.7, release-1.8, release-1.9

Children:

9a023d0

Parents:

fde6d80

git-author:

Anders Kaseorg <andersk@mit.edu> (01/25/10 21:56:47)

git-committer:

Anders Kaseorg <andersk@mit.edu> (01/30/10 21:26:54)

Message:

Move cachedmsgid from owl_filter to owl_view.

This fixes a use-after-free bug: owl_function_create_filter sets
inuse=1, removes the current filter (hence freeing it), then calls
owl_function_change_currentview_filter → owl_view_save_curmsgid →
owl_filter_set_cachedmsgid, which writes to the filter that was just
freed.

This means that you can no longer keep two independent positions in
two different filters by repeatedly switching between filter1 → empty
→ filter2 → empty → filter1.  But I doubt anyone even knew that was
possible before.

Signed-off-by: Anders Kaseorg <andersk@mit.edu>
Reviewed-by: Nelson Elhage <nelhage@mit.edu>

Files:

• filter.c (modified) (2 diffs)
• owl.h (modified) (2 diffs)
• view.c (modified) (1 diff)

filter.c

@@ -24 +24 @@
   f->fgcolor=OWL_COLOR_DEFAULT;
   f->bgcolor=OWL_COLOR_DEFAULT;
-  f->cachedmsgid=-1;
 
   /* first take arguments that have to come first */
@@ -189 +188 @@
 }
 
-void owl_filter_set_cachedmsgid(owl_filter *f, int cachedmsgid)
-{
-  f->cachedmsgid=cachedmsgid;
-}
-
-int owl_filter_get_cachedmsgid(const owl_filter *f)
-{
-  return(f->cachedmsgid);
-}
-
 /* return 1 if the message matches the given filter, otherwise
  * return 0.

owl.h

@@ -426 +426 @@
   int fgcolor;
   int bgcolor;
-  int cachedmsgid;  /* cached msgid: should move into view eventually */
 } owl_filter;
 
@@ -434 +433 @@
   owl_messagelist ml;
   const owl_style *style;
+  int cachedmsgid;
 } owl_view;
 

view.c

@@ -126 +126 @@
   int cachedid;
 
-  cachedid=owl_filter_get_cachedmsgid(v->filter);
+  cachedid = v->cachedmsgid;
   if (cachedid<0) return(0);
   return (owl_view_get_nearest_to_msgid(v, cachedid));
 }
 
-/* saves the current message position in the filter so it can 
- * be restored later if we switch back to this filter. */
 void owl_view_save_curmsgid(owl_view *v, int curid)
 {
-  owl_filter_set_cachedmsgid(v->filter, curid);
+  v->cachedmsgid = curid;
 }