Use after free in src/display.c

[Test-tools]

Hello,

thats seams to be the last serious problem place on my list...

In src/display.c line 1812
while (s->pendingDestroys)
assuming here s->pendingDestroys > 1

Then the for loop line 1816
for (w = s->windows; w; w = w->next)
It breaks out of the loop, if (w->destroyed)
But if it breaks out, then w got already free()d inside removeWindow (w),
which means that effectivly s->window is free()d.

Now, if we still have s->pendingDestroys, it would reinitialise in for() variable w with value of previously freed s->windows ...

.... Roland

[onestone]

The code is right. If you do a removeWindow(s->windows) (=remove first window in the list) then it will free that window but also set s->windows to s->windows->next (unhookWindowFromScreen (w->screen, w); in window.c);