The code to replace $wid/$pid died on $foo.

It failed to increment a variable after finding a $ but no pid or wid,
which led to a fun infinite loop. Also don't check if c[1] is w if we
already established it was p. The code should probably check the length
of the string instead of reading random memory, but how fun is that?

diff --git a/openbox/actions/execute.c b/openbox/actions/execute.c
index 121c094..376eee5 100644 (file)
--- a/openbox/actions/execute.c
+++ b/openbox/actions/execute.c
@@ -144,7 +144,7 @@ static gboolean run_func(ObActionsData *data, gpointer options)
     if (data->client) {
         gchar *c, *before, *expand;
 
-        /* replace occurances of $pid and $wid */
+        /* replace occurrences of $pid and $wid */
 
         expand = NULL;
         before = cmd;
@@ -168,8 +168,7 @@ static gboolean run_func(ObActionsData *data, gpointer options)
 
                 before = c + 4; /* 4 = strlen("$pid") */
             }
-
-            if ((c[1] == 'w' || c[1] == 'W') &&
+            else if ((c[1] == 'w' || c[1] == 'W') &&
                 (c[2] == 'i' || c[2] == 'I') &&
                 (c[3] == 'd' || c[3] == 'D') &&
                 !g_ascii_isalnum(c[4]))
@@ -187,6 +186,8 @@ static gboolean run_func(ObActionsData *data, gpointer options)
 
                 before = c + 4; /* 4 = strlen("$wid") */
             }
+            else
+                before = c + 1; /* no infinite loops plz */
         }
 
         if (expand) {