From 8a7d030af7a41589a2948d029658778b79c2a27b Mon Sep 17 00:00:00 2001
From: Chris Young <chris@unsatisfactorysoftware.co.uk>
Date: Tue, 22 Mar 2016 19:45:15 +0000
Subject: [PATCH] Ensure we don't access invalid pointers

---
 amiga/bitmap.c | 14 +++++++++++---
 amiga/bitmap.h |  6 ++++--
 2 files changed, 15 insertions(+), 5 deletions(-)

diff --git a/amiga/bitmap.c b/amiga/bitmap.c
index cb30354a2..043710261 100644
--- a/amiga/bitmap.c
+++ b/amiga/bitmap.c
@@ -59,7 +59,7 @@ struct bitmap {
 	PLANEPTR native_mask;
 	Object *dto;
 	struct nsurl *url;   /* temporary storage space */
-	const char *title; /* temporary storage space */
+	char *title; /* temporary storage space */
 	ULONG *icondata; /* for appicons */
 };
 
@@ -143,10 +143,16 @@ void amiga_bitmap_destroy(void *bitmap)
 
 		if(bm->native_mask) FreeRaster(bm->native_mask, bm->width, bm->height);
 		FreeVec(bm->pixdata);
+
+		if(bm->url) nsurl_unref(bm->url);
+		if(bm->title) free(bm->title);
+
 		bm->pixdata = NULL;
 		bm->nativebm = NULL;
 		bm->native_mask = NULL;
 		bm->dto = NULL;
+		bm->url = NULL;
+		bm->title = NULL;
 	
 		ami_misc_itempool_free(pool_bitmap, bm, sizeof(struct bitmap));
 		bm = NULL;
@@ -644,12 +650,14 @@ static nserror bitmap_render(struct bitmap *bitmap, hlcache_handle *content)
 
 void ami_bitmap_set_url(struct bitmap *bm, struct nsurl *url)
 {
-	bm->url = url;
+	if(bm->url != NULL) return;
+	bm->url = nsurl_ref(url);
 }
 
 void ami_bitmap_set_title(struct bitmap *bm, const char *title)
 {
-	bm->title = title;
+	if(bm->title != NULL) return;
+	bm->title = strdup(title);
 }
 
 ULONG *ami_bitmap_get_icondata(struct bitmap *bm)
diff --git a/amiga/bitmap.h b/amiga/bitmap.h
index a1893b317..743cd8faa 100755
--- a/amiga/bitmap.h
+++ b/amiga/bitmap.h
@@ -46,7 +46,8 @@ struct bitmap *ami_bitmap_from_datatype(char *filename);
  * \param  bm  a bitmap, as returned by bitmap_create()
  * \param  title  a pointer to a title string
  *
- * It is assumed that this is freed elsewhere after the bitmap is destroyed.
+ * A reference will be kept by the bitmap object.
+ * The URL can only ever be set once for a bitmap.
  */
 void ami_bitmap_set_url(struct bitmap *bm, struct nsurl *url);
 
@@ -56,7 +57,8 @@ void ami_bitmap_set_url(struct bitmap *bm, struct nsurl *url);
  * \param  bm  a bitmap, as returned by bitmap_create()
  * \param  title  a pointer to a title string
  *
- * It is assumed that this is freed elsewhere after the bitmap is destroyed.
+ * This is copied by the bitmap object.
+ * The title can only ever be set once for a bitmap.
  */
 void ami_bitmap_set_title(struct bitmap *bm, const char *title);