Subject: fvwm2 core dump when destroying menus containing bitmaps

From: Tim Phipps <[email-masked]>
Date: Thu, 08 Mar 2001 16:19:47 +0000

Configuration Information [Automatically generated, do not change]:
uname output: SunOS silver 5.5.1 Generic_103640-34 sun4u sparc SUNW,Ultra-5_10
Compiler: gcc
Compilation CFLAGS: -g -O2
prefix: /u/phippst/sunos

FVWM Version:	2.3.29
FVWM_MODULEDIR:	/u/phippst/sunos/libexec/fvwm/2.3.29
FVWM_DATADIR:	/u/phippst/sunos/share/fvwm
FVWM_USERDIR:	/u/phippst/.fvwm

Description:
	fvwm2 core dumps when re-reading the config file if the file
	contains a menu with xbm mini-icons, here's the trace:

#0  0xef4d17fc in _free_unlocked () from /usr/lib/libc.so.1
#1  0xef4d17bc in free () from /usr/lib/libc.so.1
#2  0x67240 in DestroyPicture (dpy=0x87be8, p=0x95c98) at Picture.c:322
#3  0x24828 in FreeMenuItem (mi=0xa37d8) at menus.c:3993
#4  0x249fc in DestroyMenu (mr=0xa2328, recreate=0) at menus.c:4068
#5  0x24bf8 in destroy_menu (eventp=0x85dec, w=54, tmp_win=0x0, context=8, 
    action=0xade87 "", Module=0xefffe2ac) at menus.c:4135
#6  0x4a918 in execute_function (efa=0xefffe298) at functions.c:1083
#7  0x4aaac in old_execute_function (action=0xefffe330 "DestroyMenu ResizeMenu\n", 
    tmp_win=0x0, eventp=0x85dec, context=8, Module=1, exec_flags=0 '\000', 
    args=0x84800) at functions.c:1152
#8  0x308b4 in run_command_stream (f=0x861f8, eventp=0x85dec, tmp_win=0x0, context=8, 
    Module=1) at read.c:142
#9  0x30a1c in run_command_file (filename=0x0, eventp=0x85dec, tmp_win=0x0, 
    context=8, Module=1) at read.c:216
#10 0x30b84 in ReadFile (eventp=0x85dec, w=54, tmp_win=0x0, context=8, 
    action=0x8b685 "/u/phippst/.fvwm2rc", Module=0xefffe94c) at read.c:268
#11 0x4a918 in execute_function (efa=0xefffe938) at functions.c:1083
#12 0x4aaac in old_execute_function (action=0x8b658 "read /u/phippst/.fvwm2rc", 
    tmp_win=0x0, eventp=0x85dec, context=8, Module=1, exec_flags=0 '\000', 
    args=0x84800) at functions.c:1152
#13 0x36d00 in ExecuteModuleCommand (w=0, module=1, 
    text=0x8b658 "read /u/phippst/.fvwm2rc") at module_interface.c:641
#14 0x382b0 in ExecuteCommandQueue () at module_interface.c:1503
#15 0x3e728 in My_XNextEvent (dpy=0x87be8, event=0x85dec) at events.c:2527
#16 0x3ea8c in HandleEvents () at events.c:2679
#17 0x5f3ec in main (argc=1, argv=0xeffff12c) at fvwm.c:746

	N.B. I used `FvwmCommand "read /u/phippst/.fvwm2rc"' but I don't think
	that is what triggers this.
	
Repeat-By:
	Here's the contents of /u/phippst/.fvwm2rc:

DestroyMenu ResizeMenu
AddToMenu ResizeMenu
+ "Which way Jim?" Title
+ %prog/space/xtrek_fed_e.xbm%" 7" my_resize_dir 0 0

	It used to contain a lot more but a binary search resulted in this,
	you may have to read this file several times to get a core dump.
	xtrek_fed_e.xbm is from the AIcons package but I would guess that any
	bitmap will do.

Fix:
	It seems like a malloc corruption, something being freed twice or old
	pointers being copied. I think the clue is in the fact that it only
	happens with bitmaps.

--
Visit the official FVWM web page at <URL:http://www.fvwm.org/>.
To unsubscribe from the list, send "unsubscribe fvwm-workers" in the
body of a message to [email-masked].
To report problems, send mail to [email-masked]

---

From: Tim Phipps <[email-masked]>
Date: Thu, 08 Mar 2001 16:40:29 +0000

Here's the offending bitmap

---

From: Dominik Vogt <[email-masked]>
Date: Sat, 10 Mar 2001 18:06:31 +0100

> 	pointers being copied. I think the clue is in the fact that it only

No, it was even simpler.  This code frees the colours allocated
for xpm files (Picture.c):

  if (p->alloc_pixels != NULL)
  {
    if (p->nalloc_pixels != 0)
    {
      XFreeColors(dpy, Pcmap, p->alloc_pixels, p->nalloc_pixels, 0);
    }
    free(p->alloc_pixels);
  }

But p->alloc_pixels was never initialised for xmb bitmaps and thus
contained a random pointer.  Fixed.

Bye

Dominik ^_^  ^_^

--
Dominik Vogt, [email-masked]
Reply-To: [email-masked]
--
Visit the official FVWM web page at <URL:http://www.fvwm.org/>.
To unsubscribe from the list, send "unsubscribe fvwm-workers" in the
body of a message to [email-masked].
To report problems, send mail to [email-masked]