Subject: CVS domivogt: * Fixed UMRs with wShaped member of the window structure (please verify thi, Dan)

From: CVS <[email-masked]>
Date: Thu, 5 Oct 2000 06:05:21 -0500 (CDT)

CVSROOT:	/home/cvs/fvwm
Module name:	fvwm
Changes by:	domivogt	00/10/05 06:05:20

Modified files:
	.              : ChangeLog 
	fvwm           : add_window.c 

Log message:
* Fixed UMRs with wShaped member of the window structure (please verify thi, Dan)

--
Visit the official FVWM web page at <URL:http://www.fvwm.org/>.
To unsubscribe from the list, send "unsubscribe fvwm-workers" in the
body of a message to [email-masked].
To report problems, send mail to [email-masked]

---

From: Dan Espen <[email-masked]>
Date: Thu, 05 Oct 2000 14:37:53 -0400

Purify output attached:

--
Dan Espen
444 Hoes Lane  Room RRC 1C-214           E-mail: [email-masked]
Piscataway, NJ 08854                     Phone: (732) 699-5570

---

From: Dominik Vogt <[email-masked]>
Date: Sat, 7 Oct 2000 22:31:46 +0200

> Purify output attached:

****  Purify instrumented fvwm2 (pid 14806)  ****
UMR: Uninitialized memory read:
  * This is occurring while in:
        SelectDecor    [decorations.c:418]
        setup_style_and_decor [add_window.c:432]
        init_style     [update.c:69]
        apply_window_updates [update.c:119]
        flush_window_updates [update.c:346]
        HandleEvents   [events.c:2402]
        main           [fvwm.c:732]
        _start         [crt1.o]
  * Reading 4 bytes from 0x34ef9c in the heap.
  * Address 0x34ef9c is 132 bytes into a malloc'd block at 0x34ef18 of 620 bytes.
  * This block was allocated from:
        malloc         [rtlib.o]
        safemalloc     [safemalloc.c:42]
        setup_window_structure [add_window.c:123]
        AddWindow      [add_window.c:1183]
        HandleMapRequestKeepRaised [events.c:894]
        HandleMapRequest [events.c:863]
        DispatchEvent  [events.c:2370]
        HandleEvents   [events.c:2410]
        main           [fvwm.c:732]
        _start         [crt1.o]

This UMR was a bit tricky to find, so perhaps someone else is
interested in what caused it.  At first I thought that Purify
was wrong.  It claims that the memory was allocated from
setup_window_structure():

  if (ReuseWin == NULL)
  {
    *ptmp_win = (FvwmWindow *)safemalloc(sizeof(FvwmWindow)); <-- 123
    if (*ptmp_win == (FvwmWindow *)0)
    {
      return False;
    }
  }
  else
  {
    ...
  }

  /*
     ...
  */
  memset(*ptmp_win, '\0', sizeof(FvwmWindow));               <-- 142

But unless safemalloc returns NULL, the whole structure is zeroed out
in line 142.  So the structure - especially the wShaped member - should
be initialised thereafter.  But later it became uninitialised again
when uninitialised data was copied there:

  void setup_style_and_decor(
    FvwmWindow *tmp_win, window_style *pstyle, short *buttons)
  {
    ...
  #ifdef SHAPE
    if (ShapesSupported)
    {
      int xws, yws, xbs, ybs;
      unsigned wws, hws, wbs, hbs;
      int boundingShaped, clipShaped;

      XShapeSelectInput(dpy, tmp_win->w, ShapeNotifyMask);
      XShapeQueryExtents(dpy, tmp_win->w,
                         &boundingShaped, &xws, &yws, &wws, &hws,
                         &clipShaped, &xbs, &ybs, &wbs, &hbs);
      tmp_win->wShaped = boundingShaped;
      ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    }
  #endif /* SHAPE */

But boundingShaped may not have been set if the XShapeQueryExtents()
call failed - which I assume is exactly what happed.

To avoid similar problems in the future it is important to always
handle return codes of X functions properly.  At least we should never
assume that a function that has a return code will always work.
A few greps revealed several other places in the code with the same
possibility of failure (e.g. with XQueryBestTile()).

Bye

Dominik ^_^  ^_^

--
Dominik Vogt, [email-masked]
Reply-To: [email-masked]
--
Visit the official FVWM web page at <URL:http://www.fvwm.org/>.
To unsubscribe from the list, send "unsubscribe fvwm-workers" in the
body of a message to [email-masked].
To report problems, send mail to [email-masked]