bugfix: avoid access after free

if src is NULL due to a previous error we cannot use it in the command
result string.

Moreover if `src` points to `p.we_wordv[0]` we cannot use it after
`wordfree(&p)` in the command result string.

Bonus feature: If there was an error accessing the file, the string
rapresentation of the error is now included in the command result
string.

1 files changed, 14 insertions, 7 deletions

diff --git a/sway/commands/output/background.c b/sway/commands/output/background.c
index 0c5c164f..82bccf68 100644
--- a/sway/commands/output/background.c
+++ b/sway/commands/output/background.c
@@ -3,6 +3,7 @@
 #include <strings.h>
 #include <unistd.h>
 #include <wordexp.h>
+#include <errno.h>
 #include "sway/commands.h"
 #include "sway/config.h"
 #include "log.h"
@@ -71,21 +72,27 @@ struct cmd_results *output_cmd_background(int argc, char **argv) {
 			if (conf) {
 				char *conf_path = dirname(conf);
 				src = malloc(strlen(conf_path) + strlen(src) + 2);
-				if (src) {
-					sprintf(src, "%s/%s", conf_path, p.we_wordv[0]);
-				} else {
+				if (!src) {
+					free(conf);
+					wordfree(&p);
 					wlr_log(L_ERROR,
-						"Unable to allocate background source");
+						"Unable to allocate resource: Not enough memory");
+					return cmd_results_new(CMD_FAILURE, "output",
+						"Unable to allocate resources");
 				}
+				sprintf(src, "%s/%s", conf_path, p.we_wordv[0]);
 				free(conf);
 			} else {
 				wlr_log(L_ERROR, "Unable to allocate background source");
 			}
 		}
-		if (!src || access(src, F_OK) == -1) {
+
+		if (access(src, F_OK) == -1) {
+			struct cmd_results *cmd_res = cmd_results_new(CMD_FAILURE, "output",
+				"Unable to access background file '%s': %s", src, strerror(errno));
+			free(src);
 			wordfree(&p);
-			return cmd_results_new(CMD_INVALID, "output",
-				"Background file unreadable (%s).", src);
+			return cmd_res;
 		}
 
 		output->background = strdup(src);