commit c484365208722b9c2e899350edef2d923d2ed0e7
from: Stefan Sperling <stsp@stsp.name>
date: Mon Aug 12 08:55:58 2019 UTC

fix double-free when blame view is closed in error path; found by otto@

commit - d264cece68c918e89cb32801e6f50b1135f47f8f
commit + c484365208722b9c2e899350edef2d923d2ed0e7
blob - c2007483c77ff28ae3a09b834b916ed062103fdf
blob + 85ed066ab0b8a250a49ed66532ba91b8d9fdf3da
--- tog/tog.c
+++ tog/tog.c
@@ -3257,18 +3257,21 @@ open_blame_view(struct tog_view *view, char *path,
 
 	SIMPLEQ_INIT(&s->blamed_commits);
 
+	s->path = strdup(path);
+	if (s->path == NULL)
+		return got_error_from_errno("strdup");
+
 	err = got_object_qid_alloc(&s->blamed_commit, commit_id);
-	if (err)
+	if (err) {
+		free(s->path);
 		return err;
+	}
 
 	SIMPLEQ_INSERT_HEAD(&s->blamed_commits, s->blamed_commit, entry);
 	s->first_displayed_line = 1;
 	s->last_displayed_line = view->nlines;
 	s->selected_line = 1;
 	s->blame_complete = 0;
-	s->path = path;
-	if (s->path == NULL)
-		return got_error_from_errno("open_blame_view");
 	s->repo = repo;
 	s->refs = refs;
 	s->commit_id = commit_id;