Fix UAF bug in Window

[Ollie-Pearce]

Window derives Clone, which bitwise-copies its pointer field. The Drop implementation for Window frees the pointee unconditionally, so cloning an instance of Window and dropping both copies causes a double-free.

// src/graphics/mod.rs
#[derive(Clone)]
pub struct Window {
    handle: af_window,
    row: i32,
    col: i32,
    cmap: ColorMap,
}

impl Drop for Window {
    fn drop(&mut self) {
        let err_val = unsafe { af_destroy_window(self.handle) };
        match err_val {
            0 => (),
            _ => panic!(
                "Window object destruction failed with error code: {}",
                err_val
            ),
        }
    }

Reproducing:

#[test]
fn uaf_Window() {
    let foo = Window::new(400, 300, "uaf".to_string());
    let bar = foo.clone();
    drop(foo);
    drop(bar);
}

You should be able to run the above test with valgrind and see an Invalid read error.

cargo test --test repro --no-run
valgrind --leak-check=no ./target/debug/deps/repro-<HASH>

Fix:

• Remove #[derive(Clone)] from Window