From c089c6aea4c948762e4f8098ddb84743356401cb Mon Sep 17 00:00:00 2001
From: Petre Rodan <2b4eda@subdimension.ro>
Date: Fri, 6 Jan 2023 06:58:11 +0200
Subject: [PATCH] Fix segfault on right-click sweep of menu

bug description: after menu is displayed I get a segfault when trying to hover over the last menu
entry. it looks like under some circumstances menu->entries[] gets accessed past the last valid
value (off by one).

how to reproduce:
right-click desktop to show menu and keep right mouse button pressed
sweep mouse up-down the menu a few times - it crashes all the time between 1-5 sweeps

this commit fixes the unwanted behaviour, in active use since december 2021.
---
 src/menu.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/menu.c b/src/menu.c
index ebdd2b43..4116cbf8 100644
--- a/src/menu.c
+++ b/src/menu.c
@@ -1764,7 +1764,7 @@ static void menuMouseDown(WObjDescriptor * desc, XEvent * event)
 		goto byebye;
 	}
 	entry_no = getEntryAt(menu, x, y);
-	if (entry_no >= 0) {
+	if ((entry_no >= 0) && (entry_no < menu->entry_no)) {
 		entry = menu->entries[entry_no];
 
 		if (!close_on_exit && (bev->state & ControlMask) && smenu && entry->flags.editable) {
@@ -1940,7 +1940,7 @@ static void menuMouseDown(WObjDescriptor * desc, XEvent * event)
 
 			if (!delayed_select) {
 				entry_no = getEntryAt(menu, x, y);
-				if (entry_no >= 0) {
+				if ((entry_no >= 0) && (entry_no < menu->entry_no)) {
 					entry = menu->entries[entry_no];
 					if (entry->flags.enabled && entry->cascade >= 0 && menu->cascades) {
 						WMenu *submenu = menu->cascades[entry->cascade];