From eb77aabea1029d97489611c71c11ab32e7329cee Mon Sep 17 00:00:00 2001
From: oga <oga>
Date: Tue, 8 Apr 2008 17:38:27 +0000
Subject: [PATCH] No cookie for okan.

fix use-after-free that broke exec's path getting stuff.

``paths'' isn't used anymore, but pointers to within that array are still
used in the next loop. delay freeing it until after then.
---
 kbfunc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kbfunc.c b/kbfunc.c
index 36d543e..31404c8 100644
--- a/kbfunc.c
+++ b/kbfunc.c
@@ -307,7 +307,6 @@ kbfunc_exec(struct client_ctx *scratch, void *arg)
 			ap++;
 	}
 	*ap = NULL;
-	xfree(path);
 	for (i = 0; i < NPATHS && paths[i] != NULL; i++) {
 		if ((dirp = opendir(paths[i])) == NULL)
 			continue;
@@ -351,6 +350,7 @@ kbfunc_exec(struct client_ctx *scratch, void *arg)
 		}
 		(void) closedir(dirp);
 	}
+	xfree(path);
 
 	if ((mi = search_start(&menuq,
 		    search_match_exec, NULL, label, 1)) != NULL) {