Subject: DestroyStyle "*"

From: [email-masked]
Date: Sun, 6 Feb 2000 14:18:21 -0600 (CST)

Full_Name: Ben Winslow
Version: CVS
CVS_Date: Sun Feb  6 15:12:48 EST 2000
OS: Linux Portal 2.2.14 #1 Sun Jan 9 15:17:04 EST 2000 i686 unknown
X_Server: XFree86 Version 3.9.17  / X Window System
Submission from: (NULL) (206.228.71.228)

DestroyStyle "*" will cause fvwm2 to crash miserably while reading
the configuration file

--
Visit the official FVWM web page at <URL:http://www.fvwm.org/>.
To unsubscribe from the list, send "unsubscribe fvwm-workers" in the
body of a message to [email-masked].
To report problems, send mail to [email-masked]

---

From: Dominik Vogt <[email-masked]>
Date: Mon, 7 Feb 2000 07:24:16 +0100

> DestroyStyle "*" will cause fvwm2 to crash miserably while reading

My - of course it will.  You really shouldn't do this.  It certainly can't
be fixed easily (in a way that the style is destroyed and fvwm doesn't
crash at the same time).

Bye

Dominik ^_^

-- 
Dominik Vogt, Agilent Technologies, Dept. BVS
Herrenberger Str.130, 71034 Boeblingen, Germany
phone: 07031/464-4596, fax: 07031/464-3883, [email-masked]
--
Visit the official FVWM web page at <URL:http://www.fvwm.org/>.
To unsubscribe from the list, send "unsubscribe fvwm-workers" in the
body of a message to [email-masked].
To report problems, send mail to [email-masked]

---

From: Brad Giaccio <[email-masked]>
Date: Mon, 7 Feb 2000 08:47:42 -0500

> be fixed easily (in a way that the style is destroyed and fvwm doesn't

Dominik,

Is there a way to give an error message in such a case, instead of just
saying don't do that?  Maybe we just add a condition to the DestroyStyle
function that will just return if style is *.
 
Brad
-- 
--- There are two kinds of knowledge, you either know the answer or
			you know where to find it
		      -Kane, Johnson, and anonymous
--
Visit the official FVWM web page at <URL:http://www.fvwm.org/>.
To unsubscribe from the list, send "unsubscribe fvwm-workers" in the
body of a message to [email-masked].
To report problems, send mail to [email-masked]

---

From: Tim Phipps <[email-masked]>
Date: Mon, 07 Feb 2000 13:51:58 +0000

> function that will just return if style is *.

Even better would be to reset the style * settings to the default.

Cheers,
Tim.

---

From: Dominik Vogt <[email-masked]>
Date: Mon, 7 Feb 2000 15:26:24 +0100

> function that will just return if style is *.

Hm, I checked fvwm.c and can't find a reason why fvwm
should crash.  The only thing it really needs are window
colours.  If I destroy "*", the windows come up with funny
coulors but it doesn't crash.  What does a stack trace
say?

Bye

Dominik ^_^

---

From: Ben Winslow <[email-masked]>
Date: Mon, 7 Feb 2000 12:27:34 -0500

> coulors but it doesn't crash.  What does a stack trace

#0  0x40168ece in chunk_alloc (ar_ptr=0x401f8160, nb=152) at malloc.c:2822
2822    malloc.c: No such file or directory.
(gdb) bt
#0  0x40168ece in chunk_alloc (ar_ptr=0x401f8160, nb=152) at malloc.c:2822
#1  0x401686a0 in __libc_malloc (bytes=144) at malloc.c:2643
#2  0x8086067 in safemalloc (length=144) at safemalloc.c:42
#3  0x805e944 in ProcessNewStyle (eventp=0x808fa80, w=44, tmp_win=0x0,
    context=8,
    action=0x80a227e "\"*\" RandomPlacement, Color White #555555, NoIcon\n",
    Module=0xbfffefa0) at style.c:624
#4  0x8071b19 in ExecuteFunction (
    Action=0xbfffefbc "Style \"*\" RandomPlacement, Color White #555555,
NoIcon\n", tmp_win=0x0, eventp=0x808fa80, context=8, Module=-1,
    expand_cmd=EXPAND_COMMAND) at functions.c:833
#5  0x807fdad in run_command_stream (f=0x80a0b80, eventp=0x808fa80,
    tmp_win=0x0, context=8, Module=-1) at read.c:81
#6  0x807ff15 in run_command_file (filename=0x8092f70 "/rain/.fvwm2/menu",
    eventp=0x808fa80, tmp_win=0x0, context=8, Module=-1) at read.c:154
#7  0x8068095 in main (argc=2, argv=0xbffff824) at fvwm.c:635

Usually, whenever chunk_alloc fails, it's because because something has
overflowed it's bounds...  Bounds checking reveals:

style.c:431:Bounds error: attempt to reference memory overrunning the end of an
object.
style.c:431:  Pointer value: 0x821d300, Size: 144
style.c:431:  Object `token':
style.c:431:    Address in memory:    0xbfffed54 .. 0xbfffed57
style.c:431:    Size:                 4 bytes
style.c:431:    Element size:         4 bytes
style.c:431:    Number of elements:   1
style.c:431:    Created at:           style.c, line 606
style.c:431:    Storage class:        stack

#0  0x4012f681 in __kill () from /lib/libc.so.6
#1  0x4012f2ce in raise (sig=6) at ../sysdeps/posix/raise.c:27
#2  0x40130993 in abort () at ../sysdeps/generic/abort.c:88
#3  0x81938de in __bounds_error_size ()
#4  0x8191e8a in __bounds_check_reference ()
#5  0x80bb984 in add_style_to_list (new_style=0x821d300) at style.c:431
#6  0x80d2a07 in ProcessNewStyle (eventp=0x81cd180, w=44, tmp_win=0x0,
    context=8, action=0x824934b "", Module=0xbfffef18) at style.c:2163
#7  0x81311f3 in ExecuteFunction (
    Action=0xbfffef48 "Style \"*\" IconBox 0 -0 -0 -0, ClickToFocus, HandleWidth 2, CleverPlacement\n", tmp_win=0x0, eventp=0x81cd180, context=8, Module=-1,
    expand_cmd=EXPAND_COMMAND) at functions.c:833
#8  0x8173824 in run_command_stream (f=0x821d100, eventp=0x81cd180,
    tmp_win=0x0, context=8, Module=-1) at read.c:81
#9  0x8173d6d in run_command_file (filename=0x81d2e00 "/rain/.fvwm2/menu",
    eventp=0x81cd180, tmp_win=0x0, context=8, Module=-1) at read.c:154
#10 0x80f2a31 in main (argc=3, argv=0xbffff9a4) at fvwm.c:635

#5  0x80bb984 in add_style_to_list (new_style=0x821d300) at style.c:431
431         SSET_NEXT_STYLE(*last_style_in_list, new_style);

.fvwm2rc:
DestroyStyle "*"
Style "*" IconBox 0 -0 -0 -0, ClickToFocus, HandleWidth 2, CleverPlacement

The actual crash is on the 'Style' line, implying that the DestroyStyle
screwed up the linked list.

-- 
Ben Winslow           /   [email-masked]
bluecherry internet   /   http://www.bluecherry.net
|Rain| @ IRC          /   anynet: irc.anynet.org

---

From: Dominik Vogt <[email-masked]>
Date: Thu, 10 Feb 2000 10:56:24 +0100

> style.c:431:    Storage class:        stack

Oh well, some internal pointer got screwed up.  I think I've
fixed it.  Try replacing the remove_all_of_style_from_list()
with this new version:

static void remove_all_of_style_from_list(char *style_ref)
{
  window_style *nptr = all_styles;
  window_style *lptr = NULL;

  /* loop though styles */
  while (nptr)
  {
    /* Check if it's to be wiped */
    if (!strcmp(SGET_NAME(*nptr), style_ref ))
    {
      window_style *tmp_ptr = nptr;

      /* Reset nptr now */
      nptr = SGET_NEXT_STYLE(*nptr);

      /* Is it the first one? */
      if (NULL == lptr)
      {
        /* Yup - reset all_styles */
        all_styles = nptr;
      }
      else
      {
        /* Middle of list */
        SSET_NEXT_STYLE(*lptr, nptr);
      }
      /* fix list end pointer */
      if (last_style_in_list == tmp_ptr)
        last_style_in_list = lptr;

      free_style(tmp_ptr);
      /* Free style */
      free( tmp_ptr );
    }
    else
    {
      /* No match - move on */
      lptr = nptr;
      nptr = SGET_NEXT_STYLE(*nptr);
    }
  }

} /* end function */

Does this fix the crash?

Bye

Dominik ^_^

---

From: Ben Winslow <[email-masked]>
Date: Thu, 10 Feb 2000 15:37:27 -0500

> fixed it.  Try replacing the remove_all_of_style_from_list()
[snip]
> Dominik ^_^
Yes and no.  Now there's a new crash:

style.c:2566:Bounds error: attempt to reference a NULL or ILLEGAL pointer.
style.c:2566:  Pointer value: ILLEGAL

#0  0x4012f681 in __kill () from /lib/libc.so.6
#1  0x4012f2ce in raise (sig=6) at ../sysdeps/posix/raise.c:27
#2  0x40130993 in abort () at ../sysdeps/generic/abort.c:88
#3  0x8195f02 in __bounds_error ()
#4  0x8191baf in __bounds_check_reference_obj ()
#5  0x80d50c3 in update_window_color_hi_style (tmp_win=0x825a000,
    pstyle=0xbfffee08) at style.c:2566
#6  0x80e2ffb in setup_style_and_decor (tmp_win=0x825a000,
pstyle=0xbfffee08,
    buttons=0xbfffede6) at add_window.c:440
#7  0x80e9619 in AddWindow (w=23068758, ReuseWin=0x0) at add_window.c:1269
#8  0x80d9c4b in HandleMapRequestKeepRaised (KeepRaised=0, ReuseWin=0x0)
    at events.c:1072
#9  0x80f4afc in CaptureAllWindows () at fvwm.c:906
#10 0x80f3c1b in StartupStuff () at fvwm.c:743
#11 0x80dfb99 in My_XNextEvent (dpy=0x8222000, event=0x81cfe80)
    at events.c:2267
#12 0x80d5e10 in HandleEvents () at events.c:244
#13 0x80f3b17 in main (argc=1, argv=0xbffff824) at fvwm.c:710

---

From: Dominik Vogt <[email-masked]>
Date: Fri, 11 Feb 2000 09:56:47 +0100

> style.c:2566:  Pointer value: ILLEGAL

Um, style.c, line 2566?  style.c is only 2535 lines long.
Can you check this again with current CVS code?

Bye

Dominik ^_^