From 117e24dbf4e5a54c8209f7415a97dbd2da906cd5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Ekl=C3=B6f?= <daniel@ekloef.se>
Date: Mon, 28 Jun 2021 22:33:57 +0200
Subject: [PATCH] term: destroy: free URLs before free:ing the grids
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fixes use-after-free when destroying a terminal with “live”
URLs (i.e. when URL mode is active).
---
 terminal.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/terminal.c b/terminal.c
index cb836fef..6c175147 100644
--- a/terminal.c
+++ b/terminal.c
@@ -1425,10 +1425,10 @@ term_destroy(struct terminal *term)
     }
     mtx_unlock(&term->render.workers.lock);
 
+    urls_reset(term);
+
     free(term->vt.osc.data);
     free(term->vt.osc8.uri);
-    grid_free(&term->normal);
-    grid_free(&term->alt);
 
     composed_free(term->composed);
 
@@ -1471,9 +1471,11 @@ term_destroy(struct terminal *term)
 
     sixel_fini(term);
 
-    urls_reset(term);
     term_ime_reset(term);
 
+    grid_free(&term->normal);
+    grid_free(&term->alt);
+
     free(term->foot_exe);
     free(term->cwd);