From 5db6c990b93262ab78879bc7c8221a97eb8626cd Mon Sep 17 00:00:00 2001
From: Rodrigo Arias Mallo <rodarima@gmail.com>
Date: Wed, 12 Jun 2024 21:19:46 +0200
Subject: Fix segfault in Done button of downloads

The destructor was using a harcoded index to the elements to free from
the original array of arguments used to call the wget program. When the
user agent was introduced, the index of the elements that require free()
shifted, causing the free() call to operate on the constant string of
the user agent instead.

Rather than relying on the hardcoded index, two new pointers hold the
values of the strings that need to be free()'d in the destructor.
Further additions in the argument array won't cause more problems.

Reported-by: pastebin <pastebin@gmx.com>
Fixes: https://github.com/dillo-browser/dillo/issues/196
See: https://lists.mailman3.com/hyperkitty/list/dillo-dev@mailman3.com/message/IPWQYKTYTO5G2BH3UU5224FRUFWCVGSO/
---
 ChangeLog        |  1 +
 dpi/downloads.cc | 11 ++++++-----
 2 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index afd4bb29..f3b65cc0 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -11,6 +11,7 @@ dillo-3.2.0 [Not released yet]
 +- Add new_tab_page option to open a custom new tab page.
    Patches: Alex, Rodrigo Arias Mallo
 +- Ignore empty page title for tab labels.
+   Fix segfault when clicking the "Done" button in downloads dialog.
    Patches: Rodrigo Arias Mallo
 
 dillo-3.1.1 [Jun 8, 2024]
diff --git a/dpi/downloads.cc b/dpi/downloads.cc
index 303bf231..90f7b76d 100644
--- a/dpi/downloads.cc
+++ b/dpi/downloads.cc
@@ -99,6 +99,8 @@ class DLItem {
    pid_t mPid;
    int LogPipe[2];
    char *shortname, *fullname;
+   char *esc_url;
+   char *cookies_path;
    char *target_dir;
    size_t log_len, log_max;
    int log_state;
@@ -286,7 +288,6 @@ DLItem::DLItem(const char *full_filename, const char *url)
 {
    struct stat ss;
    const char *p;
-   char *esc_url;
 
    if (pipe(LogPipe) < 0) {
       MSG("pipe, %s\n", dStrerror(errno));
@@ -320,6 +321,7 @@ DLItem::DLItem(const char *full_filename, const char *url)
    /* avoid malicious SMTP relaying with FTP urls */
    if (dStrnAsciiCasecmp(esc_url, "ftp:/", 5) == 0)
       Filter_smtp_hack(esc_url);
+   cookies_path = dStrconcat(dGethomedir(), "/.dillo/cookies.txt", NULL);
    dl_argv = new char*[10];
    int i = 0;
    const char *user_agent = "Dillo/" VERSION;
@@ -330,7 +332,7 @@ DLItem::DLItem(const char *full_filename, const char *url)
    dl_argv[i++] = (char*) user_agent;
    dl_argv[i++] = (char*)"-c";
    dl_argv[i++] = (char*)"--load-cookies";
-   dl_argv[i++] = dStrconcat(dGethomedir(), "/.dillo/cookies.txt", NULL);
+   dl_argv[i++] = cookies_path;
    dl_argv[i++] = (char*)"-O";
    dl_argv[i++] = fullname;
    dl_argv[i++] = esc_url;
@@ -432,9 +434,8 @@ DLItem::~DLItem()
    dFree(fullname);
    dFree(target_dir);
    free(log_text);
-   int idx = (strcmp(dl_argv[1], "-c")) ? 2 : 3;
-   dFree(dl_argv[idx]);
-   dFree(dl_argv[idx+3]);
+   dFree(esc_url);
+   dFree(cookies_path);
    delete [] dl_argv;
 
    delete(group);
-- 
cgit v1.2.3