2.5: Fix a case of using freed memory in event handling.

1 files changed, 9 insertions, 3 deletions

diff --git a/source/blender/windowmanager/intern/wm_event_system.c b/source/blender/windowmanager/intern/wm_event_system.c
index 189594a4947..e520067b9e5 100644
--- a/source/blender/windowmanager/intern/wm_event_system.c
+++ b/source/blender/windowmanager/intern/wm_event_system.c
@@ -733,17 +733,20 @@ static int wm_handler_ui_call(bContext *C, wmEventHandler *handler, wmEvent *eve
 	ScrArea *area= CTX_wm_area(C);
 	ARegion *region= CTX_wm_region(C);
 	ARegion *menu= CTX_wm_menu(C);
-	int retval;
+	int retval, always_pass;
 			
 	/* we set context to where ui handler came from */
 	if(handler->ui_area) CTX_wm_area_set(C, handler->ui_area);
 	if(handler->ui_region) CTX_wm_region_set(C, handler->ui_region);
 	if(handler->ui_menu) CTX_wm_menu_set(C, handler->ui_menu);
 
+	/* in advance to avoid access to freed event on window close */
+	always_pass= wm_event_always_pass(event);
+
 	retval= handler->ui_handle(C, event, handler->ui_userdata);
 
 	/* putting back screen context */
-	if((retval != WM_UI_HANDLER_BREAK) || wm_event_always_pass(event)) {
+	if((retval != WM_UI_HANDLER_BREAK) || always_pass) {
 		CTX_wm_area_set(C, area);
 		CTX_wm_region_set(C, region);
 		CTX_wm_menu_set(C, menu);
@@ -872,6 +875,7 @@ static int wm_handlers_do(bContext *C, wmEvent *event, ListBase *handlers)
 {
 	wmEventHandler *handler, *nexthandler;
 	int action= WM_HANDLER_CONTINUE;
+	int always_pass;
 
 	if(handlers==NULL) return action;
 	
@@ -881,6 +885,8 @@ static int wm_handlers_do(bContext *C, wmEvent *event, ListBase *handlers)
 
 		/* optional boundbox */
 		if(handler_boundbox_test(handler, event)) {
+			/* in advance to avoid access to freed event on window close */
+			always_pass= wm_event_always_pass(event);
 		
 			/* modal+blocking handler */
 			if(handler->flag & WM_HANDLER_BLOCKING)
@@ -912,7 +918,7 @@ static int wm_handlers_do(bContext *C, wmEvent *event, ListBase *handlers)
 				action= wm_handler_operator_call(C, handlers, handler, event, NULL);
 			}
 
-			if(!wm_event_always_pass(event) && action==WM_HANDLER_BREAK)
+			if(!always_pass && action==WM_HANDLER_BREAK)
 				break;
 		}