From 5e85bf72104667613e701e6ce75e1dc0501dbdc7 Mon Sep 17 00:00:00 2001
From: Thomas James Alexander Thurman <tthurman@src.gnome.org>
Date: Sat, 22 Jul 2006 01:45:21 +0000
Subject: [PATCH] Avoid a case where a struct's fields might be updated after
 it was freed.

* ui.[ch] (filter_func): Avoid a case where a struct's
fields might be updated after it was freed. #348067.
---
 ChangeLog |  5 +++++
 src/ui.c  | 15 +++++++++------
 2 files changed, 14 insertions(+), 6 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 2dda0b4a6..c8dc8929d 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2006-07-21  Thomas Thurman <thomas@thurman.org.uk>
+
+	* ui.[ch] (filter_func): Avoid a case where a struct's
+	fields might be updated after it was freed. #348067.
+
 2006-07-10  Elijah Newren  <newren gmail com>
 
 	* configure.in: post-release version bump to 2.15.13
diff --git a/src/ui.c b/src/ui.c
index 19cbe9cf1..cc067e3ff 100644
--- a/src/ui.c
+++ b/src/ui.c
@@ -70,26 +70,29 @@ struct _EventFunc
   int last_event_serial;
 };
 
+static EventFunc *ef = NULL;
+
 static GdkFilterReturn
 filter_func (GdkXEvent *xevent,
              GdkEvent *event,
              gpointer data)
 {
-  EventFunc *ef;
-
-  ef = data;
+  g_return_if_fail (ef != NULL);
 
   if ((* ef->func) (xevent, ef->data))
     return GDK_FILTER_REMOVE;
   else
     {
-      ef->last_event_serial = ((XEvent*)xevent)->xany.serial;
+      /* ef would be NULL here if we removed the filter function
+       * in response to the event.
+       */
+      if (ef != NULL)
+        ef->last_event_serial = ((XEvent*)xevent)->xany.serial;
+
       return GDK_FILTER_CONTINUE;
     }
 }
 
-static EventFunc *ef = NULL;
-
 void
 meta_ui_add_event_func (Display       *xdisplay,
                         MetaEventFunc  func,