From 8c282db2259397f588adf119fc0f776e0d777a38 Mon Sep 17 00:00:00 2001
From: "Unknown W. Brackets" <checkins@unknownbrackets.org>
Date: Sun, 23 Jun 2019 11:13:14 -0700
Subject: [PATCH 1/2] UI: Clear queued events on Event destruct.

May help a crash seen in #11890.
---
 ext/native/ui/view.cpp | 24 +++++++++++++++++++++---
 ext/native/ui/view.h   |  4 +---
 2 files changed, 22 insertions(+), 6 deletions(-)

diff --git a/ext/native/ui/view.cpp b/ext/native/ui/view.cpp
index 2a0fc2cbb6..378290f951 100644
--- a/ext/native/ui/view.cpp
+++ b/ext/native/ui/view.cpp
@@ -60,9 +60,22 @@ void DispatchEvents() {
 }
 
 void RemoveQueuedEvents(View *v) {
-	for (size_t i = 0; i < g_dispatchQueue.size(); i++) {
-		if (g_dispatchQueue[i].params.v == v)
-			g_dispatchQueue.erase(g_dispatchQueue.begin() + i);
+	for (auto it = g_dispatchQueue.begin(); it != g_dispatchQueue.end(); ) {
+		if (it->params.v == v) {
+			it = g_dispatchQueue.erase(it);
+		} else {
+			++it;
+		}
+	}
+}
+
+void RemoveQueuedEvents(Event *e) {
+	for (auto it = g_dispatchQueue.begin(); it != g_dispatchQueue.end(); ) {
+		if (it->e == e) {
+			it = g_dispatchQueue.erase(it);
+		} else {
+			++it;
+		}
 	}
 }
 
@@ -157,6 +170,11 @@ EventReturn Event::Dispatch(EventParams &e) {
 	return UI::EVENT_SKIPPED;
 }
 
+Event::~Event() {
+	handlers_.clear();
+	RemoveQueuedEvents(this);
+}
+
 View::~View() {
 	if (HasFocus())
 		SetFocusedView(0);
diff --git a/ext/native/ui/view.h b/ext/native/ui/view.h
index 45d0538d44..c59110c0d2 100644
--- a/ext/native/ui/view.h
+++ b/ext/native/ui/view.h
@@ -240,9 +240,7 @@ struct HandlerRegistration {
 class Event {
 public:
 	Event() {}
-	~Event() {
-		handlers_.clear();
-	}
+	~Event();
 	// Call this from input thread or whatever, it doesn't matter
 	void Trigger(EventParams &e);
 	// Call this from UI thread

From eaba867f28752e55ad2d1b2b29f456f7a9dc39fb Mon Sep 17 00:00:00 2001
From: "Unknown W. Brackets" <checkins@unknownbrackets.org>
Date: Sun, 23 Jun 2019 11:25:27 -0700
Subject: [PATCH 2/2] SaveState: Fail load on decompression error.

Simply checking the size isn't enough, because it doesn't write the
decompressed size in the case of invalid data.

May help the crash in #11890.
---
 Common/ChunkFile.cpp | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/Common/ChunkFile.cpp b/Common/ChunkFile.cpp
index 4e2334e735..22327a7575 100644
--- a/Common/ChunkFile.cpp
+++ b/Common/ChunkFile.cpp
@@ -249,19 +249,27 @@ CChunkFileReader::Error CChunkFileReader::LoadFile(const std::string &filename,
 		return ERROR_BAD_FILE;
 	}
 
-	_buffer = buffer;
 	if (header.Compress) {
 		u8 *uncomp_buffer = new u8[header.UncompressedSize];
 		size_t uncomp_size = header.UncompressedSize;
-		snappy_uncompress((const char *)buffer, sz, (char *)uncomp_buffer, &uncomp_size);
+		auto status = snappy_uncompress((const char *)buffer, sz, (char *)uncomp_buffer, &uncomp_size);
+		if (status != SNAPPY_OK) {
+			ERROR_LOG(SAVESTATE, "ChunkReader: Failed to decompress file");
+			delete [] uncomp_buffer;
+			delete [] buffer;
+			return ERROR_BAD_FILE;
+		}
 		if ((u32)uncomp_size != header.UncompressedSize) {
 			ERROR_LOG(SAVESTATE, "Size mismatch: file: %u  calc: %u", header.UncompressedSize, (u32)uncomp_size);
 			delete [] uncomp_buffer;
+			delete [] buffer;
 			return ERROR_BAD_FILE;
 		}
 		_buffer = uncomp_buffer;
 		sz = uncomp_size;
 		delete [] buffer;
+	} else {
+		_buffer = buffer;
 	}
 
 	if (header.GitVersion[31]) {