When replacing, don't free the old paste until after the new one's name

has been copied. Fixes a use-after-free in window-copy.c. Bug reported
by J Raynor (who also provided a different fix).

1 files changed, 3 insertions, 3 deletions

diff --git a/paste.c b/paste.c
index de80115e..2ccc3cd2 100644
--- a/paste.c
+++ b/paste.c
@@ -247,9 +247,6 @@ paste_set(char *data, size_t size, const char *name, char **cause)
 		return (-1);
 	}
 
-	pb = paste_get_name(name);
-	if (pb != NULL)
-		paste_free_name(name);
 
 	pb = xmalloc(sizeof *pb);
 
@@ -261,6 +258,9 @@ paste_set(char *data, size_t size, const char *name, char **cause)
 	pb->automatic = 0;
 	pb->order = paste_next_order++;
 
+	if (paste_get_name(name) != NULL)
+		paste_free_name(name);
+
 	RB_INSERT(paste_name_tree, &paste_by_name, pb);
 	RB_INSERT(paste_time_tree, &paste_by_time, pb);