Both files in this commit exhibit use after free errors.

One of them was introduced in my memory leak fixing (whoops). I was freeing
a structure of stock data before one last call to it. So switching the free
to after that call fixed it.

The kcheckers.cpp fix is one where the game board could be deleted and then
a new one is not created because someone attempted to request a game board
type that is not supported. This is fixed by using the default directive for
one of the game board types in the switch statement. Which means it could
default to Russian boards. Score one for the Russians!

2 files changed, 4 insertions, 4 deletions

diff --git a/noncore/games/kcheckers/kcheckers.cpp b/noncore/games/kcheckers/kcheckers.cpp
index a27dd18..433c68f 100644
--- a/noncore/games/kcheckers/kcheckers.cpp
+++ b/noncore/games/kcheckers/kcheckers.cpp
@@ -385,96 +385,97 @@ void KCheckers::help()
     "the board becomes a king.\n"
     "The kings move forward or\n"
     "backward:\n"
     "- to one square only (english rules);\n"
     "- to any number of squares (russian\n"
     "  rules).\n"
     "The kings capture by jumping\n"
     "forward or backward.\n"
     "Whenever a player is able to make a\n"
     "capture he must do so.",
     QMessageBox::Ok|QMessageBox::Default);
 }
 
 
 void KCheckers::about()
 {
   QMessageBox::about(this,"About KCheckers",
     "KCheckers, a board game. Ver 0.3\n"
     "(C) 2002, A. Peredri <andi@ukr.net>\n\n"
     "http://kcheckers.tuxfamily.org\n\n"
     "Contributors:\n"
     "S. Rosen <srosen@erols.com>\n\n"
     "Qtopia version: S.Prud'homme\n"
     "<prudhomme@laposte.net>\n\n"
     "This program is distributed under the\n"
     "terms of the GNU General Public\n"
     "License.");
 }
 
 
 void KCheckers::aboutQt()
 {
   QMessageBox::aboutQt(this);
 }
 
 
 void KCheckers::newGame()
 {
   if(game) delete game;
 
   switch(rules)
   {
     case ENGLISH:
       game=new ECheckers(skill);
       CHECK_PTR(game);
       break;
 
     case RUSSIAN:
+    default:
       game=new RCheckers(skill);
       CHECK_PTR(game);
   }
 
   unselect();
   gameOver=false;
 
   gameMenu->setItemEnabled(undoID,false);
   undoButton->setEnabled(false);
 
   colorChange();
 
   for(int i=0;i<32;i++) drawBoard(i);
   if(optionsMenu->isItemChecked(numID)) drawNumeration();
 
   if(!userFirst) compGo();
 
   statusLabel->setText(tr("Go!"));
 }
 
 
 // Undo the last computer and user moves
 
 void KCheckers::undoMove()
 {
   for(int i=0;i<32;i++)
   {
     game->board[t[i]]=undoBoard[i];
     drawBoard(i);
   }
 
   unselect();
   gameOver=false;
 
   gameMenu->setItemEnabled(undoID,false);
   undoButton->setEnabled(false);
 
   statusLabel->setText(tr("Go!"));
 }
 
 
 void KCheckers::colorChange()
 {
   userFirst=!userFirst;
 
   QImage* image;
   image=imageMan1;
   imageMan1=imageMan2;
diff --git a/noncore/todayplugins/stockticker/libstocks/currency.c b/noncore/todayplugins/stockticker/libstocks/currency.c
index e0090e2..82cd654 100644
--- a/noncore/todayplugins/stockticker/libstocks/currency.c
+++ b/noncore/todayplugins/stockticker/libstocks/currency.c
@@ -11,57 +11,56 @@
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.	 See the GNU
  * Library General Public License for more details.
  *
  * You should have received a copy of the GNU Library General Public
  * License along with this library; if not, write to the
  * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
  * Boston, MA 02111-1307, USA.
  */
 
 #define __CURRENCY_C__
 
 
 #include <stdio.h>
 #include <string.h>
 #include <malloc.h>
 #include <stdlib.h>
 
 #include "stocks.h"
 
 /*****************************************************************************/
 /* returns the currency exchange rate of "from" currency into                */
 /* "into" currency.                                                          */
 /*****************************************************************************/
 libstocks_return_code get_currency_exchange(char *from, 
 					    char *into, 
 					    float *exchange)
 {
   char *symbol;
   stock *data;
   libstocks_return_code error;
 
   if((symbol = (char *)malloc(strlen(from)+strlen(into)+3))==NULL)
     {
       fprintf(stderr,"Memory allocating error (%s line %d)\n"
 	      ,__FILE__, __LINE__);
       exit(1);
     }
 
   strcpy(symbol, from);
   strcat(symbol, into);
   strcat(symbol, "=X");
   
   error = get_stocks(symbol, &data);
   free(symbol);
   if (error) 
     {
       *exchange = 0;
-      return(error);
+      return error;
     }
 
-  free_stocks(data);
-
   *exchange = data->CurrentPrice;
-  return(error);
+  free_stocks(data);
+  return error;
  
 }