Subject: module core dumps in fvwm-themes

From: Mikhael Goikhman <[email-masked]>
Date: Mon, 5 Mar 2001 19:24:45 -0600

If you run fvwm-themes, the following commands bring some GUI's,
which, when pressing their first button, cause core dumps:

  FvwmScript FvwmScript-ColorSelector
  FvwmForm FvwmForm-ThemeSettings

Core was generated by `/opt/fvwm/libexec/fvwm/2.3.30/FvwmScript 25 4 none
0 8 FvwmScript-ColorSelector'.
Program terminated with signal 11, Segmentation fault.
#0  0x804f584 in SendToScript (NbArg=2, TabArg=0x808fab8)
    at Instructions.c:1395
1395     R=(char*)safecalloc(strlen(x11base->TabScriptId[dest])+1,sizeof(char));
(gdb) where
#0  0x804f584 in SendToScript (NbArg=2, TabArg=0x808fab8)
    at Instructions.c:1395
#1  0x804b5df in ExecBloc (bloc=0x80909c0) at FvwmScript.c:442
#2  0x804ec4f in IfThen (NbArg=5, TabArg=0x80909a8) at Instructions.c:1197
#3  0x804b5df in ExecBloc (bloc=0x8090648) at FvwmScript.c:442
#4  0x804bab3 in SendMsg (xobj=0x809dc98, TypeMsg=-1) at FvwmScript.c:600
#5  0x8058725 in EvtMousePushButton (xobj=0x809dc98, EvtButton=0x80684e0)
    at PushButton.c:199
#6  0x804be1b in ReadXServer () at FvwmScript.c:709
#7  0x804c136 in MainLoop () at FvwmScript.c:821
#8  0x804c715 in main (argc=7, argv=0xbffff3c4) at FvwmScript.c:1027
#9  0x40167e51 in __libc_start_main (main=0x804c458 <main>, argc=7, 
    ubp_av=0xbffff3c4, init=0x8049fa0 <_init>, fini=0x80600ec <_fini>, 
    rtld_fini=0x4000e264 <_dl_fini>, stack_end=0xbffff3bc)
    at ../sysdeps/generic/libc-start.c:111
(gdb) print x11base
$1 = (X11base *) 0x0
(gdb) 

Core was generated by `/opt/fvwm/libexec/fvwm/2.3.30/FvwmForm 25 4 none 0
8 FvwmForm-ThemeSettings'.
Program terminated with signal 11, Segmentation fault.
#0  0x804cc63 in ParseActiveMessage (
    buf=0x8056adc "Colorset 22 ffffff b18885 e5cfce 564645 0 0 0 0 0 0 0 0")
    at FvwmForm.c:1648
1648            item->header.dt_ptr->dt_used = 0;
(gdb) where
#0  0x804cc63 in ParseActiveMessage (
    buf=0x8056adc "Colorset 22 ffffff b18885 e5cfce 564645 0 0 0 0 0 0 0 0")
    at FvwmForm.c:1648
#1  0x804cacf in ReadFvwm () at FvwmForm.c:1581
#2  0x804cf8e in MainLoop () at FvwmForm.c:1731
#3  0x804d30e in main (argc=7, argv=0xbffff3c4) at FvwmForm.c:1882
#4  0x40167e51 in __libc_start_main (main=0x804cfcc <main>, argc=7, 
    ubp_av=0xbffff3c4, init=0x8049744 <_init>, fini=0x805379c <_fini>, 
    rtld_fini=0x4000e264 <_dl_fini>, stack_end=0xbffff3bc)
    at ../sysdeps/generic/libc-start.c:111
(gdb) print item->header.dt_ptr
$1 = (DrawTable *) 0x0
(gdb) 

Regards,
Mikhael.
--
Visit the official FVWM web page at <URL:http://www.fvwm.org/>.
To unsubscribe from the list, send "unsubscribe fvwm-workers" in the
body of a message to [email-masked].
To report problems, send mail to [email-masked]

---

From: Dan Espen <[email-masked]>
Date: Mon, 05 Mar 2001 21:38:35 -0500

>   FvwmForm FvwmForm-ThemeSettings
...
> (gdb) print item->header.dt_ptr

The logic to apply colorsets to items in the item linklist
was assuming that all items have a "DrawTable" (color).
Selections get item entries but they don't display anything.

I don't use Colorsets, but I think its fixed.

--
Dan Espen
444 Hoes Lane  Room RRC 1C-214           E-mail: [email-masked]
Piscataway, NJ 08854                     Phone: (732) 699-5570
--
Visit the official FVWM web page at <URL:http://www.fvwm.org/>.
To unsubscribe from the list, send "unsubscribe fvwm-workers" in the
body of a message to [email-masked].
To report problems, send mail to [email-masked]

---

From: Dominik Vogt <[email-masked]>
Date: Wed, 7 Mar 2001 20:08:00 +0100

>     at ../sysdeps/generic/libc-start.c:111

Well, if someone feels able to debug FvwmScript, feel free.  I
don't.

Bye

Dominik ^_^  ^_^

--
Dominik Vogt, [email-masked]
Reply-To: [email-masked]
--
Visit the official FVWM web page at <URL:http://www.fvwm.org/>.
To unsubscribe from the list, send "unsubscribe fvwm-workers" in the
body of a message to [email-masked].
To report problems, send mail to [email-masked]

---

From: Dan Espen <[email-masked]>
Date: Wed, 07 Mar 2001 17:53:42 -0500

> Well, if someone feels able to debug FvwmScript, feel free.  I

Well, with a challenge like that, who can resist.

It would help if I spoke French.  Any volunteers to supply an
French to English patch?

The problem seems to be the zero in x11base.  I searched for
straight assignments, and things using &x11base.  The only thing I
see is:

  x11base=(X11base*) safecalloc(1,sizeof(X11base));

at line 956 in main().

Clearly the program has gone beyond that since its entered MainLoop().

I'd have to guess that theres a wild pointer in there somewhere.
I can Purify it if I get the script definition.

I have to say, this is a pretty amazing piece of code.

---

From: Olivier Chapuis <[email-masked]>
Date: Thu, 8 Mar 2001 09:23:51 +0100

> > >   FvwmScript FvwmScript-ColorSelector

This script is part of fvwm-themes distrib you can start it via
Fvwm Configuration -> Utilities -> Colors selector 
I do not get a core dump, the core dump is produced by a machine
which run BSD I think.

> It would help if I spoke French.  Any volunteers to supply an

I will make some translation when I will have some times. I will
try to help debugging too. It seems that there are problems also
with multibyte enabled.
 
> I can Purify it if I get the script definition.

Any report on how fvwm-themes work on Solaris is welcome :o)

Olivier

---

From: Mikhael Goikhman <[email-masked]>
Date: Thu, 8 Mar 2001 04:50:59 -0600

> I do not get a core dump, the core dump is produced by a machine

This is what I though too (BSD specific), but the report in this thread is
done on my linux machine (both core dumps). No Multibyte charset support.
The second (FvwmForm) core dump is fixed.

Regards,
Mikhael.

---

From: Dan Espen <[email-masked]>
Date: Thu, 08 Mar 2001 18:05:22 -0500

> I can Purify it if I get the script definition.

Sorry to say that Purify doesn't help.  It core dumps but heres all I get:

NPR: Null pointer read:
  * This is occurring while in:
	strlen         [rtlib.o]
	SendToScript   [Instructions.c:1395]
	ExecBloc       [FvwmScript.c:442]
	IfThen         [Instructions.c:1195]
	ExecBloc       [FvwmScript.c:442]
	SendMsg        [FvwmScript.c:600]
	EvtMousePushButton [PushButton.c:199]
	ReadXServer    [FvwmScript.c:709]
	MainLoop       [FvwmScript.c:821]
	main           [FvwmScript.c:1027]
	_start         [crt1.o]
  * Reading 1 byte from 0x0

That looks like the same thing gdb gives us.

---

From: Dan Espen <[email-masked]>
Date: Thu, 08 Mar 2001 21:28:01 -0500

Dan Espen <[email-masked]> writes:
> > > 1395     R=(char*)safecalloc(strlen(x11base->TabScriptId[dest])+1,sizeof(
> ch
> > ar));
> > > (gdb) where
...
> Well, with a challenge like that, who can resist.

I'm starting to appreciate the difficulty.
Somethings fishy, in my case, x11base is not zero.

Anyway, during testing I managed to core dump fvwm using the Themes
menus.  I think was popping up a menu 3 levels deep and missed with
a click.  It gives me a stack like this:

#0  0x1e108 in MenuInteraction (pmp=0xffbecca8, pmret=0xffbecf58, 
    pdkp=0xffbecad0, pdo_warp_to_title=0xbd634)
    at ../../version-2_3_30/fvwm/menus.c:1602
1602		else if (MI_IS_POPUP(mi) && mrMi == pmp->menu)
(gdb) where
#0  0x1e108 in MenuInteraction (pmp=0xffbecca8, pmret=0xffbecf58, 
    pdkp=0xffbecad0, pdo_warp_to_title=0xbd634)
    at ../../version-2_3_30/fvwm/menus.c:1602
#1  0x1be1c in do_menu (pmp=0xffbecca8, pmret=0xffbecf58)
    at ../../version-2_3_30/fvwm/menus.c:786
#2  0x1fbe8 in MenuInteraction (pmp=0xffbecf68, pmret=0xffbecf58, 
    pdkp=0xffbece50, pdo_warp_to_title=0xbd634)
    at ../../version-2_3_30/fvwm/menus.c:2203
#3  0x1be1c in do_menu (pmp=0xffbecf68, pmret=0xffbecf58)
    at ../../version-2_3_30/fvwm/menus.c:786
#4  0x2b098 in menu_func (eventp=0xbed4c, w=42, tmp_win=0x0, context=8, 
    action=0x0, Module=0xffbed1ac, fStaysUp=1)
    at ../../version-2_3_30/fvwm/menus.c:5495
#5  0x2b174 in staysup_func (eventp=0xbed4c, w=42, tmp_win=0x0, context=8, 
    action=0xeb415 "MenuFvwmRoot", Module=0xffbed1ac)
    at ../../version-2_3_30/fvwm/menus.c:5511
#6  0x6b03c in execute_function (efa=0xffbed198)
    at ../../version-2_3_30/fvwm/functions.c:1083
#7  0x6b2b8 in old_execute_function (action=0x11ab08 "Menu MenuFvwmRoot", 
    tmp_win=0x0, eventp=0xbed4c, context=8, Module=-1, exec_flags=0 '\000', 
    args=0x0) at ../../version-2_3_30/fvwm/functions.c:1152
#8  0x53984 in HandleButtonPress () at ../../version-2_3_30/fvwm/events.c:1622
#9  0x5629c in DispatchEvent (preserve_Tmp_win=0)
    at ../../version-2_3_30/fvwm/events.c:2676
#10 0x563e8 in HandleEvents () at ../../version-2_3_30/fvwm/events.c:2729
#11 0x8e664 in main (argc=4, argv=0xffbed834)
    at ../../version-2_3_30/fvwm/fvwm.c:751
(gdb) print mi
$1 = (MenuItem *) 0x0
(gdb) print mrMi
$2 = (MenuRoot *) 0x10c770
(gdb) print pmp
$3 = (MenuParameters *) 0xffbecca8
(gdb) 

I think I'm fairly current with CVS.

---

From: Olivier Chapuis <[email-masked]>
Date: Fri, 9 Mar 2001 08:27:06 +0100

> That looks like the same thing gdb gives us.

In fact the core dump is not really generated by FvwmScript it is
generated by the script which contains a programming error.
I am sorry it was a stupid error. In general, FvwmScript does not
make a lot of consistancy test in the Script. E.g., if you
call a Widget which does not exists FvwmScript will core dump.
So, in fact the core dump above is not a bug but a feature.

Sorry, Olivier

---

From: Dominik Vogt <[email-masked]>
Date: Sat, 10 Mar 2001 17:22:39 +0100

> 1602		else if (MI_IS_POPUP(mi) && mrMi == pmp->menu)

Ah, yes.  I forgot to check if mi is not NULL before accessing it.
Consider this fixed.

Bye

Dominik ^_^  ^_^