Fix memory free invalid read errors

src/client.c

@@ -1394,12 +1394,6 @@ client_remove(struct client *c)
      XReparentWindow(W->dpy, c->win, W->root, c->rgeo.x, c->rgeo.y);
      XUngrabButton(W->dpy, AnyButton, AnyModifier, c->win);
      ewmh_set_wm_state(c->win, WithdrawnState);
-
-     /* Remove frame */
-     if(c->titlebar)
-          barwin_remove(c->titlebar);
-     XDestroyWindow(W->dpy, c->frame);
-
      XSync(W->dpy, false);
      XSetErrorHandler(wmfs_error_handler);
      XUngrabServer(W->dpy);
@@ -1407,6 +1401,11 @@ client_remove(struct client *c)
      SLIST_REMOVE(&W->h.client, c, client, next);
      tag_client(NULL, c);
 
+     /* Remove frame */
+     if(c->titlebar)
+          barwin_remove(c->titlebar);
+     XDestroyWindow(W->dpy, c->frame);
+
      free(c);
      ewmh_get_client_list();
 }

src/infobar.c

@@ -396,18 +396,6 @@ infobar_elem_update(struct infobar *i, int type)
                e->func_update(e);
 }
 
-void
-infobar_elem_remove(struct element *e)
-{
-     struct barwin *b;
-
-     TAILQ_REMOVE(&e->infobar->elements, e, next);
-
-     ELEM_FREE_BARWIN(e);
-
-     free(e);
-}
-
 void
 infobar_elem_reinit(struct infobar *i)
 {
@@ -490,6 +478,7 @@ void
 infobar_remove(struct infobar *i)
 {
      struct element *e;
+     struct barwin *b;
 
      free(i->elemorder);
      free(i->name);
@@ -497,8 +486,13 @@ infobar_remove(struct infobar *i)
      if(i == W->systray.infobar)
           systray_freeicons();
 
-     TAILQ_FOREACH(e, &i->elements, next)
+     while(!TAILQ_EMPTY(&i->elements))
-          infobar_elem_remove(e);
+     {
+          e = TAILQ_FIRST(&i->elements);
+          TAILQ_REMOVE(&i->elements, e, next);
+          ELEM_FREE_BARWIN(e);
+          free(e);
+     }
 
      barwin_remove(i->bar);
 

src/layout.c

@@ -95,8 +95,9 @@ layout_free_set(struct tag *t)
 {
      struct layout_set *l;
 
-     TAILQ_FOREACH(l, &t->sets, next)
+     while(!TAILQ_EMPTY(&t->sets))
      {
+          l = TAILQ_FIRST(&t->sets);
           TAILQ_REMOVE(&t->sets, l, next);
           FREE_LIST(geo_list, l->geos);
           free(l);

src/status.c

@@ -64,13 +64,8 @@ void
 status_free_ctx(struct status_ctx *ctx)
 {
      free(ctx->status);
-
-     if(ctx->barwin)
-          SLIST_INIT(&ctx->barwin->statusmousebinds);
-
      status_flush_list(ctx);
      status_gcache_free(ctx);
-
 }
 
 static void

src/tag.c

@@ -282,8 +282,6 @@ uicb_tag_del(Uicb cmd)
 void
 tag_free(struct screen *s)
 {
-     struct tag *t;
+     while(!TAILQ_EMPTY(&s->tags))
-
+          tag_remove(TAILQ_FIRST(&s->tags));
-     TAILQ_FOREACH(t, &s->tags, next)
-          tag_remove(t);
 }