Fix use-after-free bug with cached settings values

This patch fixes a couple of use-after-free bugs when caching various
string related setting values.

Fixes: #143

2 files changed, 28 insertions, 10 deletions

diff --git a/src/fe-common/core/chat-completion.c b/src/fe-common/core/chat-completion.c
index aba76b9d..c37c77cd 100644
--- a/src/fe-common/core/chat-completion.c
+++ b/src/fe-common/core/chat-completion.c
@@ -40,7 +40,7 @@
 
 static int keep_privates_count, keep_publics_count;
 static int completion_lowercase;
-static const char *completion_char, *cmdchars;
+static char *completion_char, *cmdchars;
 static GSList *global_lastmsgs;
 static int completion_auto, completion_strict;
 
@@ -1126,11 +1126,16 @@ static void read_settings(void)
 	keep_privates_count = settings_get_int("completion_keep_privates");
 	keep_publics_count = settings_get_int("completion_keep_publics");
 	completion_lowercase = settings_get_bool("completion_nicks_lowercase");
-	completion_char = settings_get_str("completion_char");
-	cmdchars = settings_get_str("cmdchars");
+
 	completion_auto = settings_get_bool("completion_auto");
 	completion_strict = settings_get_bool("completion_strict");
 
+	g_free_not_null(completion_char);
+	completion_char = g_strdup(settings_get_str("completion_char"));
+
+	g_free_not_null(cmdchars);
+	cmdchars = g_strdup(settings_get_str("cmdchars"));
+
 	if (*completion_char == '\0') {
                 /* this would break.. */
 		completion_auto = FALSE;
@@ -1220,4 +1225,7 @@ void chat_completion_deinit(void)
 	signal_remove("server disconnected", (SIGNAL_FUNC) sig_server_disconnected);
 	signal_remove("channel destroyed", (SIGNAL_FUNC) sig_channel_destroyed);
 	signal_remove("setup changed", (SIGNAL_FUNC) read_settings);
+
+	g_free_not_null(completion_char);
+	g_free_not_null(cmdchars);
 }
diff --git a/src/fe-common/core/fe-log.c b/src/fe-common/core/fe-log.c
index 5ee72d8b..9d68faf9 100644
--- a/src/fe-common/core/fe-log.c
+++ b/src/fe-common/core/fe-log.c
@@ -43,11 +43,11 @@
 
 static int autolog_level;
 static int autoremove_tag;
-static const char *autolog_path;
+static char *autolog_path;
 
 static THEME_REC *log_theme;
 static int skip_next_printtext;
-static const char *log_theme_name;
+static char *log_theme_name;
 
 static int log_dir_create_mode;
 
@@ -675,9 +675,11 @@ static void sig_theme_destroyed(THEME_REC *theme)
 static void read_settings(void)
 {
 	int old_autolog = autolog_level;
-        int log_file_create_mode;
+	int log_file_create_mode;
+
+	g_free_not_null(autolog_path);
+	autolog_path = g_strdup(settings_get_str("autolog_path"));
 
-	autolog_path = settings_get_str("autolog_path");
 	autolog_level = !settings_get_bool("autolog") ? 0 :
 		settings_get_level("autolog_level");
 
@@ -687,9 +689,14 @@ static void read_settings(void)
 	/* write to log files with different theme? */
 	if (log_theme_name != NULL)
 		signal_remove("print format", (SIGNAL_FUNC) sig_print_format);
-	log_theme_name = settings_get_str("log_theme");
-	if (*log_theme_name == '\0')
+
+	g_free_not_null(log_theme_name);
+	log_theme_name = g_strdup(settings_get_str("log_theme"));
+
+	if (*log_theme_name == '\0') {
+		g_free(log_theme_name);
 		log_theme_name = NULL;
+	}
 	else
 		signal_add("print format", (SIGNAL_FUNC) sig_print_format);
 
@@ -752,7 +759,7 @@ void fe_log_deinit(void)
 {
 	g_source_remove(autoremove_tag);
 	if (log_theme_name != NULL)
-                signal_remove("print format", (SIGNAL_FUNC) sig_print_format);
+		signal_remove("print format", (SIGNAL_FUNC) sig_print_format);
 
 	command_unbind("log", (SIGNAL_FUNC) cmd_log);
 	command_unbind("log open", (SIGNAL_FUNC) cmd_log_open);
@@ -776,4 +783,7 @@ void fe_log_deinit(void)
 
 	if (autolog_ignore_targets != NULL)
 		g_strfreev(autolog_ignore_targets);
+
+	g_free_not_null(autolog_path);
+	g_free_not_null(log_theme_name);
 }