con_mark: fix heap-use-after-free

diff --git a/src/con.c b/src/con.c
index ccc8445e1df2c54a6f3a371eec06337452fe42d4..51b2a3f606e5c9ad533d4fc9d27d16ba1e7e93d2 100644 (file)
--- a/src/con.c
+++ b/src/con.c
@@ -608,7 +608,8 @@ void con_mark(Con *con, const char *mark, mark_mode_t mode) {
         DLOG("Removing all existing marks on con = %p.\n", con);
 
         mark_t *current;
-        TAILQ_FOREACH(current, &(con->marks_head), marks) {
+        while (!TAILQ_EMPTY(&(con->marks_head))) {
+            current = TAILQ_FIRST(&(con->marks_head));
             con_unmark(con, current->name);
         }
     }