commit 0ebf279d89965e36833b47a357da8000bfe528b0
from: Karsten Pedersen <kpedersen@disroot.org>
via: Dan Cross <crossd@gmail.com>
date: Wed Jul 27 14:19:26 2022 UTC

Fixed a use after free in rio.
Screen was being queried from within a client after it had been free'd.

commit - 45124b23d284d1e205d830591007b7415440b70e
commit + 0ebf279d89965e36833b47a357da8000bfe528b0
blob - 33951151ee71d782d1feaade7546a8d2bc3f0970
blob + b068a101de251ed23379d961d322d284d4d2e00a
--- src/cmd/rio/manage.c
+++ src/cmd/rio/manage.c
@@ -116,9 +116,10 @@ manage(Client *c, int mapped)
 		}
 
 		if(c->is9term && !(fixsize ? drag(c, Button3) : sweep(c, Button3))){
+			ScreenInfo *screen = c->screen;
 			XKillClient(dpy, c->window);
 			rmclient(c);
-			if(current && current->screen == c->screen)
+			if(current && current->screen == screen)
 				cmapfocus(current);
 			return 0;
 		}