Fix use after free in menu_entry_frame_free
authorEdward Sheldrake <ejsheldrake@gmail.com>
Tue, 28 Oct 2014 00:28:35 +0000 (01:28 +0100)
committerMikael Magnusson <mikachu@gmail.com>
Tue, 28 Oct 2014 03:14:24 +0000 (04:14 +0100)
openbox/menuframe.c

index c390c07..7868df3 100644 (file)
@@ -203,8 +203,6 @@ static ObMenuEntryFrame* menu_entry_frame_new(ObMenuEntry *entry,
 static void menu_entry_frame_free(ObMenuEntryFrame *self)
 {
     if (self) {
-        menu_entry_unref(self->entry);
-
         window_remove(self->window);
 
         XDestroyWindow(obt_display, self->text);
@@ -221,6 +219,7 @@ static void menu_entry_frame_free(ObMenuEntryFrame *self)
             g_hash_table_remove(menu_frame_map, &self->bullet);
         }
 
+        menu_entry_unref(self->entry);
         g_slice_free(ObMenuEntryFrame, self);
     }
 }