From 03fa233ff7bbf262bdfdbb3d427460e8944a42bb Mon Sep 17 00:00:00 2001
From: Ollie <ollie@agent>
Date: Fri, 29 May 2026 17:06:19 +0200
Subject: [PATCH] =?UTF-8?q?wview:=20remove=20view=20from=20lookup=20table?=
 =?UTF-8?q?=20in=20destroyView=20before=20freeing=20=E2=80=94=20fix=20use-?=
 =?UTF-8?q?after-free=20race?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 WINGs/wview.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/WINGs/wview.c b/WINGs/wview.c
index 0029937..aa16848 100644
--- a/WINGs/wview.c
+++ b/WINGs/wview.c
@@ -318,6 +318,11 @@ static void destroyView(W_View * view)
 		return;
 	view->flags.alreadyDead = 1;
 
+	/* Remove from view lookup table before freeing memory.
+	 * Otherwise a concurrent W_GetViewForWindow can return a
+	 * dangling pointer after wfree(view) reuses the memory. */
+	view_table_remove(view->window);
+
 	/* delete the balloon text for the view, if there's any */
 	WMSetBalloonTextForView(NULL, view);