From 15d647a0ec7373b4af0ebe7445e486cc2ce29d79 Mon Sep 17 00:00:00 2001
From: deepend-tildeclub <deepend@tilde.club>
Date: Fri, 22 May 2026 14:50:44 -0600
Subject: [PATCH] Fix detached tab reattach UAF crash path

---
 src/fe-gtk/maingui.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/fe-gtk/maingui.c b/src/fe-gtk/maingui.c
index 9dd386db..34c416c3 100644
--- a/src/fe-gtk/maingui.c
+++ b/src/fe-gtk/maingui.c
@@ -2705,7 +2705,6 @@ mg_changui_destroy (session *sess)
                 /* it fixes: Gdk-CRITICAL **: gdk_colormap_get_screen: */
                 /*           assertion `GDK_IS_COLORMAP (cmap)' failed */
                 ret = sess->gui->window;
-                g_free (sess->gui);
                 sess->gui = NULL;
         }
         return ret;
@@ -2727,13 +2726,17 @@ mg_link_irctab (session *sess, int focus)
                 return;
         }
 
+        session_gui *old_gui;
+
         mg_unpopulate (sess);
+        old_gui = sess->gui;
         win = mg_changui_destroy (sess);
         mg_changui_new (sess, sess->res, 1, focus);
         /* the buffer is now attached to a different widget */
         ((xtext_buffer *)sess->res->buffer)->xtext = (GtkXText *)sess->gui->xtext;
         if (win)
                 gtk_widget_destroy (win);
+        g_free (old_gui);
 }
 
 void