destroynotify-iterator-uaf.patch

From: zackattackz
Subject: [PATCH] systray: fix iterator UAF in DestroyNotify handler

handle_x_event() iterates systray.list_icons in the DestroyNotify case to
find the matching tray icon, then calls systray_destroy_event() on it.
systray_destroy_event() calls remove_icon(), which g_slist_remove()s and
g_free()s the current node. The loop then advances via it = it->next on
the freed node, and the next iteration dereferences it->data on garbage
memory (SIGSEGV).

Triggered by any tray client that destroys its window while registered --
observed with Vesktop (Discord) on quit.

Fix: break out of the loop after systray_destroy_event(). Window XIDs are
unique in systray.list_icons (enforced by add_icon()), so once the matching
icon is found and removed there is nothing further to iterate.

This is the same iterator-invalidation pattern as the sibling bug in
on_change_systray() in systraybar.c.
---
 src/main.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/main.c b/src/main.c
--- a/src/main.c
+++ b/src/main.c
@@ -540,8 +540,10 @@
             break;
         for (GSList *it = systray.list_icons; it; it = it->next)
         {
-            if (((TrayWindow *)it->data)->win == e->xany.window)
+            if (((TrayWindow *)it->data)->win == e->xany.window) {
                 systray_destroy_event(it->data);
+                break;
+            }
         }
         break;