[PATCH 1/2] client: fix double free in agent prompts

display_agent_prompt_release() destroys the stdin l_io but leaves the
file-static pointer set. Both creation sites are guarded by "if (!io)",
so it is never recreated and any later use touches freed memory.

RequestUserNameAndPassword is the only request that prompts twice, so
the password prompt installs a read handler on the destroyed io. The
input is never read and no reply is sent, and the Cancel handler or the
exit path then destroys the same io again:

  free(): double free detected in tcache 2

Clear the pointer at both destroy sites. l_io_destroy(NULL) is a no-op.

Fixes: df32279a31c3 ("client: Enable non-interactive mode support for agent prompts")
---
 client/display.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/client/display.c b/client/display.c
index f0f3282a..103e4769 100644
--- a/client/display.c
+++ b/client/display.c
@@ -860,6 +860,7 @@ void display_agent_prompt_release(const char *label)
 	if (!command_is_interactive_mode()) {
 		rl_callback_handler_remove();
 		l_io_destroy(io);
+		io = NULL;
 
 		return;
 	}
@@ -975,6 +976,7 @@ void display_exit(void)
 	rl_callback_handler_remove();
 
 	l_io_destroy(io);
+	io = NULL;
 
 	l_signal_remove(window_change_signal);
 
-- 
2.55.0