Repository: Rust-SDL2/rust-sdl2 (language: rust)

Issue:
Use-after-free in show_message_box
I noticed that, even though I specified a colour scheme, I got _random_, frequently unreadable colours on Android! I suspected this was due to a use-after-free, and sure enough, [the code](https://github.com/Rust-SDL2/rust-sdl2/blob/18a3a9b0ba407cad333aa32f50b845e478743eba/src/sdl2/messagebox.rs#L242-L248) looks like a textbook example of one:

```rust
            colorScheme: if let Some(scheme) = scheme {
                &sys::SDL_MessageBoxColorScheme {
                    colors: From::from(scheme),
                } as *const _
            } else {
                ptr::null()
            },
```

Rust's borrow-checker would complain that the `sys::SDL_MessageBoxColorScheme` object doesn't live long enough here. It's only because it's been cast to a pointer that it doesn't.

I might submit a patch for this eventually, but for the moment I'll just not use a colour scheme; I was only using one because I didn't realise I didn't have to.


Discussion / hints:
Maybe this is the cause of https://github.com/Rust-SDL2/rust-sdl2/issues/1130 too?
Sounds like it! Feel free to drop a PR.

Fix patch:
diff --git a/src/sdl2/messagebox.rs b/src/sdl2/messagebox.rs
index 10ea85b660..753cd1985e 100644
--- a/src/sdl2/messagebox.rs
+++ b/src/sdl2/messagebox.rs
@@ -232,6 +232,9 @@ where
         })
         .collect();
     let result = unsafe {
+        let scheme = scheme.map(|scheme| sys::SDL_MessageBoxColorScheme {
+            colors: scheme.into(),
+        });
         let msg_box_data = sys::SDL_MessageBoxData {
             flags: flags.bits(),
             window: window.map_or(ptr::null_mut(), |win| win.raw()),
@@ -239,13 +242,10 @@ where
             message: message.as_ptr() as *const c_char,
             numbuttons: raw_buttons.len() as c_int,
             buttons: raw_buttons.as_ptr(),
-            colorScheme: if let Some(scheme) = scheme {
-                &sys::SDL_MessageBoxColorScheme {
-                    colors: From::from(scheme),
-                } as *const _
-            } else {
-                ptr::null()
-            },
+            colorScheme: scheme
+                .as_ref()
+                .map(|p| p as *const _)
+                .unwrap_or(ptr::null()),
         };
         sys::SDL_ShowMessageBox(&msg_box_data as *const _, &mut button_id as &mut _)
     } == 0;


Test patch: