Use-after-free when saving Qt message history #996

Possibly resolve #996

win/Qt/qt_msg.cpp

@@ -100,9 +100,10 @@ const char * NetHackQtMessageWindow::GetStr(bool init)
     QListWidgetItem *item = list->item(currgetmsg++);
     if (item) {
         QString str = item->text();
-        const char *result = str.toLatin1().constData();
-        //raw_printf("getstr[%d]='%s'", currgetmsg, result);
-        return result;
+	if (str.toLatin1().length() < (int) sizeof historybuf - 1) {
+            return strcpy(historybuf, str.toLatin1().constData());
+            //raw_printf("getstr[%d]='%s'", currgetmsg, result);
+	}
     }
     return NULL;
 }

win/Qt/qt_msg.h

@@ -42,6 +42,7 @@ private:
         bool changed;
         int currgetmsg;
 	NetHackQtMapWindow2* map;
+	char historybuf[BUFSZ];
 
 private slots:
 	void updateFont();