elm/naviframe: Fix potential deref of freed memory.

We should not free it and then access the same data again on line below.

SVN revision: 80862

3 files changed, 12 insertions, 1 deletions

diff --git a/ChangeLog b/ChangeLog
index 8f7856fe7..af3ddec19 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -817,3 +817,7 @@
 2013-04-09  WooHyun Jung
 
         * When ctxpopup includes elm_list, elm_list should get focus when ctxpopup is shown.
+
+2013-06-10  Stefan Schmidt
+
+        * Fix potential free'ed memory dereference in naviframe
diff --git a/NEWS b/NEWS
index 582ab361d..09f656ac5 100644
--- a/NEWS
+++ b/NEWS
@@ -1,3 +1,10 @@
+Changes since Elementary 1.7.7:
+-------------------------
+
+Fixes:
+
+   * Fix potential free'ed memory dereference in naviframe.
+
 Elementary 1.7.7
 
 Changes since Elementary 1.7.6:
diff --git a/src/lib/elc_naviframe.c b/src/lib/elc_naviframe.c
index 5e035b8f4..db73a335b 100644
--- a/src/lib/elc_naviframe.c
+++ b/src/lib/elc_naviframe.c
@@ -600,10 +600,10 @@ _title_content_set(Elm_Naviframe_Item *it,
                   eina_stringshare_del(pair->part);
                   it->content_list = eina_inlist_remove(it->content_list,
                                                         EINA_INLIST_GET(pair));
-                  free(pair);
                   evas_object_event_callback_del(pair->content,
                                                  EVAS_CALLBACK_DEL,
                                                  _title_content_del);
+                  free(pair);
                   break;
                }
           }