menu: reset parser state in `menu_finish()`

This fixes use-after-free in `fill_item()` on Reconfigure with
invalid `menu.xml` like below:

<openbox_menu>
  <menu id="root-menu">
    <item id="rofi-run" label="Run command">
      <action name="Execute" command="rofi-run" />
    </item>
  </menu>
</openbox_menu>

diff --git a/src/menu/menu.c b/src/menu/menu.c
index 84b8679353554b21c0beb6e7fda389f3e3ae3864..064c803bdd5123095d884d3ececd9cd4208b5c94 100644 (file)
--- a/src/menu/menu.c
+++ b/src/menu/menu.c
@@ -960,6 +960,11 @@ void
 menu_finish(struct server *server)
 {
        menu_free_from(server, NULL);
+
+       /* Reset state vars for starting fresh when Reload is triggered */
+       current_item = NULL;
+       current_item_action = NULL;
+       current_menu = NULL;
 }
 
 /* Sets selection (or clears selection if passing NULL) */