From 18425cd426485bfa2634f9d5c829da25b54c9e85 Mon Sep 17 00:00:00 2001
From: nick black <dankamongmen@gmail.com>
Date: Tue, 19 Oct 2021 19:41:35 -0400
Subject: [PATCH] [ncplane_reparent_family] don't use invalid pile reference
 #1348

---
 src/lib/internal.h  | 13 +++++++++++++
 src/lib/notcurses.c | 20 ++++++--------------
 src/lib/visual.c    |  4 ++--
 3 files changed, 21 insertions(+), 16 deletions(-)

diff --git a/src/lib/internal.h b/src/lib/internal.h
index 1dea2cfdc..273089840 100644
--- a/src/lib/internal.h
+++ b/src/lib/internal.h
@@ -717,6 +717,19 @@ sprite_commit(tinfo* ti, fbuf* f, sprixel* s, unsigned forcescroll){
   return 0;
 }
 
+static inline void
+destroy_tam(ncplane* p){
+  if(p->tam){
+    for(int y = 0 ; y < p->leny ; ++y){
+      for(int x = 0 ; x < p->lenx ; ++x){
+        free(p->tam[y * p->lenx + x].auxvector);
+        p->tam[y * p->lenx + x].auxvector = NULL;
+      }
+    }
+    free(p->tam);
+  }
+}
+
 static inline int
 sprite_rebuild(const notcurses* nc, sprixel* s, int ycell, int xcell){
   logdebug("rebuilding %d %d/%d\n", s->id, ycell, xcell);
diff --git a/src/lib/notcurses.c b/src/lib/notcurses.c
index b0ad23cd7..c56c6a707 100644
--- a/src/lib/notcurses.c
+++ b/src/lib/notcurses.c
@@ -364,15 +364,7 @@ void free_plane(ncplane* p){
     if(p->sprite){
       sprixel_hide(p->sprite);
     }
-    if(p->tam){
-      for(int y = 0 ; y < p->leny ; ++y){
-        for(int x = 0 ; x < p->lenx ; ++x){
-          free(p->tam[y * p->lenx + x].auxvector);
-          p->tam[y * p->lenx + x].auxvector = NULL;
-        }
-      }
-    }
-    free(p->tam);
+    destroy_tam(p);
     egcpool_dump(&p->pool);
     free(p->name);
     free(p->fb);
@@ -2635,7 +2627,10 @@ splice_zaxis_recursive(ncplane* n, ncpile* p){
 }
 
 ncplane* ncplane_reparent_family(ncplane* n, ncplane* newparent){
-  if(n == ncplane_notcurses(n)->stdplane){
+  // ncplane_notcurses() goes through ncplane_pile(). since we're possibly
+  // destroying piles below, get the notcurses reference early on.
+  notcurses* nc = ncplane_notcurses(n);
+  if(n == nc->stdplane){
     return NULL; // can't reparent standard plane
   }
   if(ncplane_descendant_p(newparent, n)){
@@ -2654,9 +2649,6 @@ ncplane* ncplane_reparent_family(ncplane* n, ncplane* newparent){
   }
   n->bprev = NULL;
   n->bnext = NULL;
-  // ncplane_notcurses() goes through ncplane_pile(). since we're possibly
-  // destroying piles below, get the notcurses reference early on.
-  notcurses* nc = ncplane_notcurses(n);
   // if leaving a pile, extract n from the old zaxis, and also any sprixel
   sprixel* s = NULL;
   if(n == newparent || ncplane_pile(n) != ncplane_pile(newparent)){
@@ -2673,7 +2665,7 @@ ncplane* ncplane_reparent_family(ncplane* n, ncplane* newparent){
     if(ncplane_pile(n)->top == NULL){ // did we just empty our pile?
       ncpile_destroy(ncplane_pile(n));
     }
-    make_ncpile(ncplane_notcurses(n), n);
+    make_ncpile(nc, n);
     pthread_mutex_unlock(&nc->pilelock);
     splice_zaxis_recursive(n, ncplane_pile(n));
   }else{ // establish ourselves as a sibling of new parent's children
diff --git a/src/lib/visual.c b/src/lib/visual.c
index fade30e6f..c5a970247 100644
--- a/src/lib/visual.c
+++ b/src/lib/visual.c
@@ -1077,10 +1077,10 @@ ncplane* ncvisual_render_pixels(notcurses* nc, ncvisual* ncv, const struct blits
   }else{
     n->sprite = sprixel_recycle(n);
     if(n->sprite->dimy != rows || n->sprite->dimx != cols){
-      free(n->tam);
+      destroy_tam(n);
       if((n->tam = create_tam(rows, cols)) == NULL){
         ncplane_destroy(createdn);
-        return NULL;;
+        return NULL;
       }
     }
     n->sprite->dimx = cols;