From 0a3eb7d6b1ef7e9ef569dcc8e73c98a8446b52fc Mon Sep 17 00:00:00 2001
From: cinap_lenrek <cinap_lenrek@gmx.de>
Date: Thu, 18 Oct 2012 18:51:32 +0200
Subject: rio: copy window labels for menu3

as the menu is displayed, the window might go away or change its
label causing menuhit() to dereference bad memory. just strdup()
the labels before passing to menu3str to prevent accidents.
---
 sys/src/cmd/rio/rio.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/sys/src/cmd/rio/rio.c b/sys/src/cmd/rio/rio.c
index 9c8ea3f9c..87137e483 100644
--- a/sys/src/cmd/rio/rio.c
+++ b/sys/src/cmd/rio/rio.c
@@ -709,10 +709,14 @@ button3menu(void)
 	}
 	if(n >= nelem(menu3str)-Hidden)
 		n = nelem(menu3str)-Hidden-1;
-	for(i=0; i<n; i++)
-		menu3str[i+Hidden] = hidden[i]->label;
-	menu3str[i+Hidden] = nil;
-
+	for(i=0; i<n; i++){
+		free(menu3str[i+Hidden]);
+		menu3str[i+Hidden] = estrdup(hidden[i]->label);
+	}
+	for(i+=Hidden; menu3str[i]; i++){
+		free(menu3str[i]);
+		menu3str[i] = nil;
+	}
 	sweeping = 1;
 	switch(i = menuhit(3, mousectl, &menu3, wscreen)){
 	case -1:
-- 
cgit v1.2.3