fix use after free

src/client.c

@@ -66,6 +66,7 @@ Client* wm_client_create(Wm *wm, Window w)
     XGetWMName(wm->display, w, &xtp);
 
     Client *c = calloc(1, sizeof(Client));
+    assert(c);
 
     c->next = NULL;
     c->prev = NULL;
@@ -81,6 +82,7 @@ Client* wm_client_create(Wm *wm, Window w)
         strln = strlen((char*)xtp.value);
         DEBUG_PRINT("%s allocating %d bytes for c->name\n", __func__, strln)
         c->name = malloc(strln+1);
+        assert(c->name);
         strcpy(c->name, (char*)xtp.value);
     }
 

src/config.c

@@ -26,10 +26,12 @@ void wm_keybinds_init_def(Config *config)
 {
     char *st[] = {"st", NULL};
     char **sth = malloc(sizeof(st));
+    assert(sth);
     memcpy(sth, st, sizeof(st));
 
     char *dmenu[] = {"i3-dmenu-desktop", NULL};
     char **dmenuh = malloc(sizeof(dmenu));
+    assert(dmenuh);
     memcpy(dmenuh, dmenu, sizeof(dmenu));
     int size;
 
@@ -139,6 +141,7 @@ void wm_keybinds_init_def(Config *config)
     config->kb_count = size / sizeof(Keybind);
     DEBUG_PRINT("sizeof k: %d\n", size);
     config->keybinds = malloc(size);
+    assert(config->keybinds);
     memcpy(config->keybinds, k, size);
 }
 
@@ -178,6 +181,7 @@ void wm_configfile_init(ConfigFile *config, const char *filename)
     }
 
     config->available_commands = calloc(config->command_count, sizeof(ConfigCommand));
+    assert(config->available_commands);
     memcpy(config->available_commands, commands, sizeof(commands));
 }
 
@@ -337,14 +341,20 @@ void wm_configcommand_init(ConfigCommand *command)
 
     command->argv = calloc(CONFIG_ARGC_MAX, sizeof(void*));
     command->args = calloc(CONFIG_ARGC_MAX, sizeof(Arg));
+    assert(command->argv);
+    assert(command->args);
 
     for (size_t i = 0; i < CONFIG_ARGC_MAX; i++) {
         command->argv[i] = calloc(CONFIG_ARGLEN_MAX, 1);
         command->args[i].s = calloc(CONFIG_ARGLEN_MAX, 1);
         command->args[i].sl = calloc(CONFIG_ARGC_MAX, sizeof(char*));
+        assert(command->argv[i]);
+        assert(command->args[i].s);
+        assert(command->args[i].sl);
 
         for (size_t j = 0; j < CONFIG_ARGC_MAX; j++) {
             command->args[i].sl[j] = calloc(CONFIG_ARGLEN_MAX, 1);
+            assert(command->args[i].sl[j]);
         }
     }
 }

src/tests.c

@@ -16,6 +16,9 @@ static void test_wm_nodearray_push(void **state)
     TreeNode *node = wm_treenode_new(NODE_VERTICAL, NULL);
     TreeNode *node1 = wm_treenode_new(NODE_VERTICAL, node);
 
+    assert_non_null(node);
+    assert_non_null(node1);
+
     node1->id = 123;
 
     assert_null(node->parent);
@@ -35,6 +38,8 @@ static void test_wm_nodearray_push(void **state)
 static void test_wm_treenode_new(void **state)
 {
     TreeNode *node = wm_treenode_new(NODE_VERTICAL, NULL);
+
+    assert_non_null(node);
     assert_null(node->client);
     assert_non_null(node->children->nodes);
     assert_int_equal(node->children->size, 0);
@@ -47,6 +52,7 @@ static void test_wm_treenode_split_space(void **state)
 {
     /* vertical */
     TreeNode *parent = wm_treenode_new(NODE_VERTICAL, NULL);
+    assert_non_null(parent);
 
     parent->pos.x = 0;
     parent->pos.y = 0;
@@ -56,6 +62,9 @@ static void test_wm_treenode_split_space(void **state)
     TreeNode *child1 = wm_treenode_new(NODE_CLIENT, parent);
     TreeNode *child2 = wm_treenode_new(NODE_CLIENT, parent);
 
+    assert_non_null(child1);
+    assert_non_null(child2);
+
     wm_treenode_split_space(parent, &child1->pos, &child2->pos);
 
     assert_int_equal(child1->pos.x, 0);
@@ -76,6 +85,7 @@ static void test_wm_treenode_split_space(void **state)
 
     /* horizontal */
     parent = wm_treenode_new(NODE_HORIZONTAL, NULL);
+    assert_non_null(parent);
 
     parent->pos.x = 0;
     parent->pos.y = 0;
@@ -85,6 +95,9 @@ static void test_wm_treenode_split_space(void **state)
     child1 = wm_treenode_new(NODE_CLIENT, parent);
     child2 = wm_treenode_new(NODE_CLIENT, parent);
 
+    assert_non_null(child1);
+    assert_non_null(child2);
+
     wm_treenode_split_space(parent, &child1->pos, &child2->pos);
 
     assert_int_equal(child1->pos.x, 0);
@@ -111,6 +124,11 @@ static void test_wm_all_nodes_to_array(void **state)
     TreeNode *node2 = wm_treenode_new(NODE_CLIENT, NULL);
     TreeNode *node3 = wm_treenode_new(NODE_CLIENT, NULL);
 
+    assert_non_null(root);
+    assert_non_null(node1);
+    assert_non_null(node2);
+    assert_non_null(node3);
+
     const unsigned long ids[] = {1, 2, 3, 4};
 
     root->id = ids[0];
@@ -128,6 +146,7 @@ static void test_wm_all_nodes_to_array(void **state)
     assert_ptr_equal(root->children->nodes[2], node3);
 
     NodeArray *all_nodes = wm_all_nodes_to_array(root);
+    assert_non_null(all_nodes);
 
     assert_int_equal(all_nodes->size, 4);
     assert_in_set(((TreeNode*)all_nodes->nodes[0])->id, ids, 4);
@@ -148,6 +167,10 @@ static void test_wm_find_client_nodes(void **state)
     TreeNode *node1 = wm_treenode_new(NODE_CLIENT, NULL);
     TreeNode *node2 = wm_treenode_new(NODE_CLIENT, NULL);
 
+    assert_non_null(root);
+    assert_non_null(node1);
+    assert_non_null(node2);
+
     node1->client = (Client*)0x123;
     node2->client = (Client*)0x456;
 
@@ -164,6 +187,7 @@ static void test_wm_find_client_nodes(void **state)
     assert_ptr_equal(root->children->nodes[1], node2);
 
     NodeArray *client_nodes = wm_treenode_find_client_nodes(root);
+    assert_non_null(client_nodes);
 
     assert_int_equal(client_nodes->size, 2);
     assert_in_set((client_nodes->nodes[0])->id, ids, 2);
@@ -185,6 +209,14 @@ static void test_wm_treenode_remove_client1(void **state)
     TreeNode *client_node3 = wm_treenode_new(NODE_CLIENT, parent_node2);
     TreeNode *client_node4 = wm_treenode_new(NODE_CLIENT, parent_node2);
 
+    assert_non_null(root);
+    assert_non_null(parent_node1);
+    assert_non_null(parent_node2);
+    assert_non_null(client_node1);
+    assert_non_null(client_node2);
+    assert_non_null(client_node3);
+    assert_non_null(client_node4);
+
     wm_nodearray_push(root->children, parent_node1);
     wm_nodearray_push(root->children, parent_node2);
 
@@ -218,6 +250,7 @@ static void test_wm_treenode_remove_client1(void **state)
     wm_treenode_split_space(parent_node2, &client_node3->pos, &client_node4->pos);
 
     TreeNode *new_client_node = wm_treenode_remove_client(&(Wm) {0}, root, &client4);
+    assert_non_null(new_client_node);
 
     assert_ptr_equal(new_client_node, parent_node2);
     assert_int_equal(parent_node2->type, NODE_CLIENT);
@@ -239,6 +272,12 @@ static void test_wm_treenode_remove_client2(void **state)
     TreeNode *client_node2 = wm_treenode_new(NODE_CLIENT, parent_node1);
     TreeNode *client_node3 = wm_treenode_new(NODE_CLIENT, parent_node1);
 
+    assert_non_null(root);
+    assert_non_null(parent_node1);
+    assert_non_null(client_node1);
+    assert_non_null(client_node2);
+    assert_non_null(client_node3);
+
     TreeNode parent_node1_val = *parent_node1;
 
     wm_nodearray_push(root->children, parent_node1);
@@ -268,6 +307,7 @@ static void test_wm_treenode_remove_client2(void **state)
     wm_treenode_split_space(parent_node1, &client_node2->pos, &client_node3->pos);
 
     TreeNode *new_client_node = wm_treenode_remove_client(&(Wm) {0}, root, &client1);
+    assert_non_null(new_client_node);
 
     assert_ptr_equal(new_client_node, client_node2);
     assert_int_equal(root->id, parent_node1_val.id);
@@ -315,14 +355,32 @@ static void test_wm_treenode_lmd(void **state)
     TreeNode *node7 = node3->children->nodes[0];
     TreeNode *node8 = node3->children->nodes[1];
 
-    assert_int_equal(wm_treenode_lmd(node1)->id, node4->id);
-    assert_int_equal(wm_treenode_lmd(node2)->id, node4->id);
-    assert_int_equal(wm_treenode_lmd(node3)->id, node7->id);
-    assert_int_equal(wm_treenode_lmd(node4)->id, node4->id);
-    assert_int_equal(wm_treenode_lmd(node5)->id, node5->id);
-    assert_int_equal(wm_treenode_lmd(node6)->id, node6->id);
-    assert_int_equal(wm_treenode_lmd(node7)->id, node7->id);
-    assert_int_equal(wm_treenode_lmd(node8)->id, node8->id);
+    TreeNode *lmd1 = wm_treenode_lmd(node1);
+    TreeNode *lmd2 = wm_treenode_lmd(node2);
+    TreeNode *lmd3 = wm_treenode_lmd(node3);
+    TreeNode *lmd4 = wm_treenode_lmd(node4);
+    TreeNode *lmd5 = wm_treenode_lmd(node5);
+    TreeNode *lmd6 = wm_treenode_lmd(node6);
+    TreeNode *lmd7 = wm_treenode_lmd(node7);
+    TreeNode *lmd8 = wm_treenode_lmd(node8);
+
+    assert_non_null(lmd1);
+    assert_non_null(lmd2);
+    assert_non_null(lmd3);
+    assert_non_null(lmd4);
+    assert_non_null(lmd5);
+    assert_non_null(lmd6);
+    assert_non_null(lmd7);
+    assert_non_null(lmd8);
+
+    assert_ptr_equal(lmd1, node4);
+    assert_ptr_equal(lmd2, node4);
+    assert_ptr_equal(lmd3, node7);
+    assert_ptr_equal(lmd4, node4);
+    assert_ptr_equal(lmd5, node5);
+    assert_ptr_equal(lmd6, node6);
+    assert_ptr_equal(lmd7, node7);
+    assert_ptr_equal(lmd8, node8);
 }
 
 static void test_wm_is_treenode_keyroot(void **state)
@@ -396,6 +454,15 @@ static int test2_setup(void **state)
     TreeNode *node7 = wm_treenode_new(NODE_VERTICAL, node3);
     TreeNode *node8 = wm_treenode_new(NODE_VERTICAL, node3);
 
+    assert_non_null(node1);
+    assert_non_null(node2);
+    assert_non_null(node3);
+    assert_non_null(node4);
+    assert_non_null(node5);
+    assert_non_null(node6);
+    assert_non_null(node7);
+    assert_non_null(node8);
+
     wm_nodearray_push(node1->children, node2);
     wm_nodearray_push(node1->children, node3);
     wm_nodearray_push(node2->children, node4);

src/util.c

@@ -15,6 +15,7 @@ TreeNode* wm_treenode_new(NodeType type, TreeNode *parent)
 {
     DEBUG_PRINT("%s\n", __func__);
     TreeNode *node = calloc(sizeof(TreeNode), 1);
+    assert(node);
 
     node->parent = parent;
     node->type = type;
@@ -173,6 +174,7 @@ PtrArray wm_nonempty_workspaces_to_strptrarray(Wm *wm)
         TreeNode *node = wm->smon->workspaces[i].tree;
         if (!wm_treenode_is_empty(node) || (node->type == NODE_CLIENT && node->client)) {
             WmWorkspaceToStrRet *ws_str_with_index = malloc(sizeof(WmWorkspaceToStrRet));
+            assert(ws_str_with_index);
             *ws_str_with_index = (WmWorkspaceToStrRet) {
                 .ws_index = i,
                 .str = wm_treenode_to_str(wm->smon->workspaces[i].tree)
@@ -266,6 +268,7 @@ NodeArray* wm_postorder_traversal(TreeNode *tree)
     while (root != NULL || stack->size > 0) {
         if (root != NULL) {
             NodeWithIndex *n = malloc(sizeof(NodeWithIndex));
+            assert(n);
             n->node = root;
             n->index = root_index;
             wm_nodearray_push(stack, (void*)n);
@@ -428,7 +431,6 @@ void wm_treenode_remove_node(Wm *wm, TreeNode *root, TreeNode *node)
     DEBUG_PRINT("%s: other_client was NULL!\n", __func__);
 
     TreeNode *sibling_node = wm_treenode_split_get_sibling(node);
-    wm_treenode_free(node);
 
     // wm_nodearray_free(&node->children);
 
@@ -438,9 +440,15 @@ void wm_treenode_remove_node(Wm *wm, TreeNode *root, TreeNode *node)
     if (parent->parent == NULL) {
         // parent is root node
         DEBUG_PRINT("parent is root node!\n");
-        sibling_node->parent = NULL;
         assert(node->type == NODE_CLIENT);
-        node->client->ws->tree = sibling_node;
+
+        TreeNode old_root = *node->client->ws->tree;
+
+        sibling_node->parent = NULL;
+        *node->client->ws->tree = *sibling_node;
+
+        wm_nodearray_free(old_root.children);
+        free(sibling_node);
 
         node->client->ws->tree->pos = (Rect) {
             .x = wm->config.border_width, .y = wm->config.border_width + dock_y ,
@@ -464,6 +472,8 @@ void wm_treenode_remove_node(Wm *wm, TreeNode *root, TreeNode *node)
     }
 
     assert(node->client->ws->tree->children->size >= 1);
+
+    wm_treenode_free(node);
 }
 
 TreeNode* wm_treenode_split_get_sibling(TreeNode *node)
@@ -552,15 +562,17 @@ TreeNode* wm_treenode_remove_client(Wm *wm, TreeNode *root, Client *client)
     }
 
     assert(client->ws->tree->children->size >= 1);
-    return node->children->nodes[0];
+    return client->ws->tree->children->nodes[0];
 }
 
 NodeArray* wm_nodearray_new()
 {
     NodeArray *arr = calloc(1, sizeof(NodeArray));
+    assert(arr);
 
     arr->capacity = 10;
     arr->nodes = calloc(arr->capacity, sizeof(TreeNode*));
+    assert(arr->nodes);
     arr->size = 0;
 
     return arr;
@@ -573,13 +585,15 @@ void wm_nodearray_push(NodeArray *arr, TreeNode *node)
     arr->size++;
 
     if (arr->size >= arr->capacity) {
-        TreeNode* temp = calloc(arr->capacity, sizeof(TreeNode*));
+        TreeNode** temp = calloc(arr->capacity, sizeof(TreeNode*));
+        assert(temp);
         memcpy(temp, arr->nodes, arr->capacity * sizeof(TreeNode*));
         free(arr->nodes);
         size_t old_capacity = arr->capacity;
         arr->capacity = old_capacity * 2;
 
         arr->nodes = calloc(arr->capacity, sizeof(TreeNode*));
+        assert(arr->nodes);
         memcpy(arr->nodes, temp, old_capacity * sizeof(TreeNode*));
 
         free(temp);
@@ -663,6 +677,7 @@ PtrArray wm_ptrarray_new()
 
     arr.capacity = 10;
     arr.ptrs = calloc(arr.capacity, sizeof(void*));
+    assert(arr.ptrs);
     arr.size = 0;
 
     return arr;
@@ -676,12 +691,14 @@ void wm_ptrarray_push(PtrArray *arr, void* ptr)
 
     if (arr->size >= arr->capacity) {
         void* temp = calloc(arr->capacity, sizeof(void*));
+        assert(temp);
         memcpy(temp, arr->ptrs, arr->capacity * sizeof(void*));
         free(arr->ptrs);
         size_t old_capacity = arr->capacity;
         arr->capacity = old_capacity * 2;
 
         arr->ptrs = calloc(arr->capacity, sizeof(void*));
+        assert(arr->ptrs);
         memcpy(arr->ptrs, temp, old_capacity * sizeof(void*));
 
         free(temp);

src/wm.c

@@ -60,12 +60,14 @@ void wm_monitors_open_all(Wm *wm, Display *d)
 
     wm->wm_mc = count;
     wm->monitors = malloc(count * sizeof(Monitor));
+    assert(wm->monitors);
 
     for (int i = 0; i < count; i++) {
         wm->monitors[i] = wm_monitor_open(d, xsi[i]);
         //TODO: cfg
         wm->monitors[i].wscount = 9;
         wm->monitors[i].workspaces = calloc(wm->monitors[i].wscount, sizeof(Workspace));
+        assert(wm->monitors[i].workspaces);
         wm->monitors[i].selws = 0;
 
         for (size_t j = 0; j < wm->monitors[i].wscount; j++) {