From c6f736315a340d95f94812ada322b2de35f44407 Mon Sep 17 00:00:00 2001
From: Augustin Cavalier <waddlesplash@gmail.com>
Date: Fri, 21 Mar 2025 11:54:37 -0400
Subject: [PATCH] BSlider: Copy the UpdateText inside UpdateTextChanged.

We can't rely on it not changing between calls, especially as
MaxUpdateTextWidth() changes the value and re-gets it, and
that's called at the end of this method always. So we need to
keep our own copy rather than using the one that's owned by
the subclass.

Fixes a use-after-free uncovered by the guarded heap in VolumeSlider,
reported in #19493.
---
 headers/os/interface/Slider.h | 2 +-
 src/kits/interface/Slider.cpp | 5 ++++-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/headers/os/interface/Slider.h b/headers/os/interface/Slider.h
index 5f28d3d1a8..225679b89a 100644
--- a/headers/os/interface/Slider.h
+++ b/headers/os/interface/Slider.h
@@ -201,7 +201,7 @@ private:
 
 			char*				fMinLimitLabel;
 			char*				fMaxLimitLabel;
-			const char*			fUpdateText;
+			char*				fUpdateText;
 
 			int32 				fMinValue;
 			int32 				fMaxValue;
diff --git a/src/kits/interface/Slider.cpp b/src/kits/interface/Slider.cpp
index 270239d70a..b53a56a45c 100644
--- a/src/kits/interface/Slider.cpp
+++ b/src/kits/interface/Slider.cpp
@@ -208,6 +208,7 @@ BSlider::~BSlider()
 #endif
 
 	delete fModificationMessage;
+	free(fUpdateText);
 	free(fMinLimitLabel);
 	free(fMaxLimitLabel);
 }
@@ -1054,7 +1055,9 @@ BSlider::UpdateTextChanged()
 		oldWidth = StringWidth(fUpdateText);
 
 	const char* oldUpdateText = fUpdateText;
-	fUpdateText = UpdateText();
+	free(fUpdateText);
+
+	fUpdateText = strdup(UpdateText());
 	bool updateTextOnOff = (fUpdateText == NULL && oldUpdateText != NULL)
 		|| (fUpdateText != NULL && oldUpdateText == NULL);