2a2cb5c8a0ee1a1c93c64810ce664017b8b53c91
- Author
- outfoxxed <outfoxxed@outfoxxed.me>
- Committer
- outfoxxed <outfoxxed@outfoxxed.me>
- Date
Message
Fix UAF in removeFromParentRecursive
Diff
1diff --git a/src/Hy3Layout.cpp b/src/Hy3Layout.cpp
2index 95995b28aed8119cb21e56f0c57bcf8db6b4be63..5259e7f526aa047b07dc9c898e4cd315b99bbbcc 100644
3--- a/src/Hy3Layout.cpp
4+++ b/src/Hy3Layout.cpp
5@@ -332,6 +332,7 @@ Hy3Node* Hy3Node::removeFromParentRecursive() {
6 group.lastFocusedChild = group.children.front();
7 }
8
9+ auto child_size_ratio = child->size_ratio;
10 if (child != this) {
11 parent->layout->nodes.remove(*child);
12 } else {
13@@ -344,7 +345,7 @@ Hy3Node* Hy3Node::removeFromParentRecursive() {
14 child_count -= 1;
15 }
16
17- auto splitmod = -((1.0 - child->size_ratio) / child_count);
18+ auto splitmod = -((1.0 - child_size_ratio) / child_count);
19
20 for (auto* child: group.children) {
21 child->size_ratio += splitmod;