2a2cb5c8a0ee1a1c93c64810ce664017b8b53c91

Author
outfoxxed <outfoxxed@outfoxxed.me>
Committer
outfoxxed <outfoxxed@outfoxxed.me>
Date

Message

Fix UAF in removeFromParentRecursive

Diff

 1diff --git a/src/Hy3Layout.cpp b/src/Hy3Layout.cpp
 2index 95995b28aed8119cb21e56f0c57bcf8db6b4be63..5259e7f526aa047b07dc9c898e4cd315b99bbbcc 100644
 3--- a/src/Hy3Layout.cpp
 4+++ b/src/Hy3Layout.cpp
 5@@ -332,6 +332,7 @@ Hy3Node* Hy3Node::removeFromParentRecursive() {
 6 			group.lastFocusedChild = group.children.front();
 7 		}
 8 
 9+		auto child_size_ratio = child->size_ratio;
10 		if (child != this) {
11 			parent->layout->nodes.remove(*child);
12 		} else {
13@@ -344,7 +345,7 @@ Hy3Node* Hy3Node::removeFromParentRecursive() {
14 				child_count -= 1;
15 			}
16 
17-			auto splitmod = -((1.0 - child->size_ratio) / child_count);
18+			auto splitmod = -((1.0 - child_size_ratio) / child_count);
19 
20 			for (auto* child: group.children) {
21 				child->size_ratio += splitmod;