From 0d2b024d9c7830fc62e92a3fe847177527def79d Mon Sep 17 00:00:00 2001
From: Werner Almesberger <werner@almesberger.net>
Date: Sat, 20 Aug 2016 20:42:34 -0300
Subject: [PATCH] eeshow/gui/ (aoi_click): also protect from access after free

Unlike aoi_hover, aoi_click was not observed to actually run into this
problem. But better safe than sorry.
---
 eeshow/gui/aoi.c     | 8 +++++---
 eeshow/gui/aoi.h     | 2 +-
 eeshow/gui/history.c | 2 +-
 eeshow/gui/sheet.c   | 4 ++--
 4 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/eeshow/gui/aoi.c b/eeshow/gui/aoi.c
index 0d71948..45e3012 100644
--- a/eeshow/gui/aoi.c
+++ b/eeshow/gui/aoi.c
@@ -101,14 +101,16 @@ static bool need_dehover(const struct aoi *aois, int x, int y)
 }
 
 
-bool aoi_click(const struct aoi *aois, int x, int y)
+/* Pointer to the anchor needed for the same reason as in aoi_hover. */
+
+bool aoi_click(struct aoi *const *aois, int x, int y)
 {
 	const struct aoi *aoi;
 
-	if (need_dehover(aois, x, y))
+	if (need_dehover(*aois, x, y))
 		aoi_dehover();
 
-	for (aoi = aois; aoi; aoi = aoi->next)
+	for (aoi = *aois; aoi; aoi = aoi->next)
 		if (aoi->click && in_aoi(aoi, x, y)) {
 			aoi->click(aoi->user);
 			return 1;
diff --git a/eeshow/gui/aoi.h b/eeshow/gui/aoi.h
index da2955b..6ac9889 100644
--- a/eeshow/gui/aoi.h
+++ b/eeshow/gui/aoi.h
@@ -34,7 +34,7 @@ struct aoi *aoi_add(struct aoi **aois, const struct aoi *cfg);
 void aoi_update(struct aoi *aoi, const struct aoi *cfg);
 bool aoi_hover(struct aoi *const *aois, int x, int y);
 
-bool aoi_click(const struct aoi *aois, int x, int y);
+bool aoi_click(struct aoi *const *aois, int x, int y);
 
 void aoi_set_related(struct aoi *aoi, const struct aoi *related);
 
diff --git a/eeshow/gui/history.c b/eeshow/gui/history.c
index 2425765..d7d8d19 100644
--- a/eeshow/gui/history.c
+++ b/eeshow/gui/history.c
@@ -206,7 +206,7 @@ static bool history_click(void *user, int x, int y)
 {
 	struct gui_ctx *ctx = user;
 
-	if (aoi_click(ctx->aois, x, y))
+	if (aoi_click(&ctx->aois, x, y))
 		return 1;
 	hide_history(ctx);
 	return 1;
diff --git a/eeshow/gui/sheet.c b/eeshow/gui/sheet.c
index d1ec01c..3be3868 100644
--- a/eeshow/gui/sheet.c
+++ b/eeshow/gui/sheet.c
@@ -394,9 +394,9 @@ static bool sheet_click(void *user, int x, int y)
 		curr_sheet = find_corresponding_sheet(ctx->old_hist->sheets,
 		    ctx->new_hist->sheets, ctx->curr_sheet);
 
-	if (aoi_click(ctx->aois, x, y))
+	if (aoi_click(&ctx->aois, x, y))
 		return 1;
-	if (aoi_click(curr_sheet->aois,
+	if (aoi_click(&curr_sheet->aois,
 	    ex + curr_sheet->xmin, ey + curr_sheet->ymin))
 		return 1;