Subject: Heap Rot and ImagePath...?

From: Bob Woodside <[email-masked]>
Date: Tue, 16 Mar 1999 00:01:36 -0500

I've been having a strange problem for about a week and a half - since
about the time the new ImagePath command went in.

	If I specify

ImagePath   /usr/include/X11/pixmaps:/usr/include/X11/bitmaps

(merging the previous PixmapPath and IconPath statements), FVWM almost
always dies in startup - or more properly, the first time it tries to
start a module (I start up the Pager from my Init and Restart
functions). It usually fails with an error in safemalloc, which just
exits. Putting a deliberate segfault in safemalloc's failure path, I get
the following stack trace:

(gdb) bt
#0  0x80736f1 in safemalloc ()
#1  0x806710e in make_named_packet ()
#2  0x806717a in SendName ()
#3  0x8066338 in SendDataToModule ()
#4  0x805ae56 in ExecuteFunction ()
#5  0x8066c88 in HandleModuleInput ()
#6  0x805a6c2 in My_XNextEvent ()
#7  0x8058936 in HandleEvents ()
#8  0x805c6b0 in main ()
#9  0x804b3ee in ___crt_dummy__ ()
(gdb)

A little backtracking shows FVWM handling a Send_ConfigInfo request from
the module when this happens, and sending the ImagePath string to the
module.

	A couple of times I've gotten a segfault instead of this error, but I
haven't found a way to reproduce it reliably, so I have no debug
information on that.

	If I remove the module startup from InitFunc, the problem is simply
postponed till the first time (usually) that I start a module.

	If I don't specify ImagePath, the problem goes away (but, of course, my
window decorations get a bit plainer). It seems to be related to the
length of the ImagePath, not the fact that it has 2 directories. I tried
using one very long name symlinked to /usr/include/X11/pixmaps, and I
got the failure; with two very short names symlinked to these
directories -
no problem.

	Hoping to see a change in the pattern that might give me a clue, I
tried using a minimal .fvwm2rc. I removed all decors and menu styles and
almost all menus and functions (I have a lot). The result was the same.

	Since I've not seen anyone else mention a similar problem, I began to
suspect my system configuration (Linux, libc5.4.44), but it's been
rock-solid for quite a long time. It could still be the source of the
problem, but I doubt it.

	Does anyone have any idea what might have gone wrong? The last version
that I have saved that was relatively stable was from around March 4 -
shortly before the change to ImagePath went in, I believe.

- Bob
--
Visit the official FVWM web page at <URL:http://www.fvwm.org/>.
To unsubscribe from the list, send "unsubscribe fvwm-workers" in the
body of a message to [email-masked].
To report problems, send mail to [email-masked]

---

From: Brad Giaccio <[email-masked]>
Date: Tue, 16 Mar 1999 08:04:25 -0500

> got the failure; with two very short names symlinked to these

I remember seeing a patch, and I don't no if it got applied or not.  Having to do with a core dump if the ImagePath was to short.  Does anyone know if this got applied?

---

From: Dominik Vogt <[email-masked]>
Date: Tue, 16 Mar 1999 13:33:04 +0100

> I remember seeing a patch, and I don't no if it got applied or not.  Having to do with a core dump if the ImagePath was to short.  Does anyone know if this got applied?

Yes, I applied it.

Dominik

-- 
Dominik Vogt, Hewlett-Packard GmbH, Dept. BVS
Herrenberger Str.130, 71034 Boeblingen, Germany
phone: 07031/14-4596, fax: 07031/14-3883, [email-masked]
--
Visit the official FVWM web page at <URL:http://www.fvwm.org/>.
To unsubscribe from the list, send "unsubscribe fvwm-workers" in the
body of a message to [email-masked].
To report problems, send mail to [email-masked]

---

From: Steve Robbins <[email-masked]>
Date: Tue, 16 Mar 1999 09:36:31 -0500 (EST)

> rock-solid for quite a long time. It could still be the source of the

Can you send me the minimal config that exhibits the problem?  I have been
running CVS versions of fvwm without apparent problems.  I also have linux
libc 5.4.44, and start FvwmPager from init and restart, with a long
ImagePath.

--
Steve Robbins                              <[email-masked]>

When love is gone, there's always justice.
And when justice is gone, there's always force.
And when force is gone, there's always Mom.

---

From: Bob Woodside <[email-masked]>
Date: Tue, 16 Mar 1999 23:12:26 -0500

Steve Robbins <[email-masked]> wrote:
> 
> Can you send me the minimal config that exhibits the problem?  I have
> been running CVS versions of fvwm without apparent problems.  I also
> have linux libc 5.4.44, and start FvwmPager from init and restart,
> with a long ImagePath.

	Well, I finally chopped the .fvwm2rc down to the bare bones, a bit at a
time, to no avail. The minimal .fvwm2rc is attached as the first
attachment, and the output from the test run as the second.

	In the process of cutting things out, I did manage to get a couple of
the real segfaults (as opposed to my manufactured one in safemalloc).
For these, gdb always shows a stack trace something like this:

#0  0x4017375e in __libc_free (mem=0x616d7869)
(gdb) bt
#0  0x4017375e in __libc_free (mem=0x616d7869)
#1  0x8075874 in SendDataToModule (eventp=0x67616d49, w=1952534629,
    tmp_win=0x752f2068, context=1764717171,
    action=0x756c636e <Address 0x756c636e out of bounds>,
Module=0x582f6564)
    at modconf.c:157

Hmmm...stack smash in SendDataToModule...? Matter of fact, it does look
a bit fishy: check the line with the "Fixme" note. 

- Bob

#==========================================================================
#    Minimal fvwm2rc...
#==========================================================================

DeskTopSize 4x4
EdgeResistance 70 50
EdgeScroll 100 100
ClickTime 200
XORvalue 166
OpaqueMoveSize 20
#  For testing...
ModulePath /usr/local/lib/X11/fvwm2betaT:/usr/local/lib/X11/fvwm2beta:/usr/local/lib/X11/fvwm2

#==========================================================================
#  The problem ones...
#==========================================================================
#PixmapPath /usr/include/X11/pixmaps
#IconPath   /usr/include/X11/bitmaps
#  03/04/1999 - this obsoleted the previous 2 - but it doesn't work yet
#  The first one crashes...the second one works fine.
ImagePath   /usr/include/X11/pixmaps:/usr/include/X11/bitmaps
#ImagePath   /usr/include/X11/pixmaps

#==================================
# Mouse bindings:
#==================================
#   for the root window:
Mouse 1	R   	A       Menu RootMenu Nop

#===================================================
#            Init and Restart Functions 
#===================================================
AddToFunc InitFunction 	  
#+                         "I" Module FvwmBanner
#+                         "I" Exec exec strtxprogs &
+ 			  "I" Module FvwmPager 0 4

AddToFunc RestartFunction 
+ 			  "I" Module FvwmPager 0 4

#==================================================
#                  The Menus 
#==================================================

AddToMenu RootMenu	"Launch Pad"	          Title
+			"Rxvt"		          Exec exec rxvtxpm -ls -sb -sl 500 -fn 7x14 &
+ 			"Moxfm File Mgr"          Exec exec moxfm &
+                       "Xman"                    Exec exec xman -notopbox &
+                       "Xconsole"                Exec exec xconsole  -title "Console for `hostname`"&
+			""		          Nop
+			"Exit Fvwm"	          Popup Quit-Verify

AddToMenu Quit-Verify 	"Really Quit Fvwm?"                 Title
+		      	"Yes, Really Quit"                  Quit	
+		      	""		                    Nop	
+		      	""		                    Nop	
+		      	"Nahhh- Restart a WM"		    Title
+		      	""		    		    Nop	
+                       "Restart Fvwm2"     		    Restart fvwm2
+                       ""                  		    Nop
+                       "Restart Fvwm - last good CVS"      Restart fvwm2.3
+                       "Restart Fvwm - new CVS build"      Restart fvwm2.3T
+		      	""		    		    Nop
+		      	"Start an xterm and punt"           Restart xterm
+		      	""		    Nop	
+		      	"No, Don't Quit"    Nop	

#============================================
#    The Module Settings
#============================================
########################### Pager #########################################
#*FvwmPagerBack #908090
*FvwmPagerBack OldLace
*FvwmPagerFore #484048
*FvwmPagerFont -adobe-helvetica-bold-r-*-*-10-*-*-*-*-*-*-*
#*FvwmPagerHilight #cab3ca
*FvwmPagerHilight bisque
*FvwmPagerLabel -2 "Really Stupid"
*FvwmPagerLabel -1 "DumbDesk1"
*FvwmPagerLabel 0 Main Desk
*FvwmPagerLabel 1 Communications
*FvwmPagerLabel 2 "Artsy-Fartsy Stuff"
*FvwmPagerLabel 3 Scientific
*FvwmPagerLabel 4 Uebrigens
*FvwmPagerDeskTopScale 40
*FvwmPagerSmallFont 5x8
*FvwmPagerGeometry -0-0
#*FvwmPagerBalloons

	Output from Bare Bones Test Run:
	================================

drbob:/bob3/src/WM/FvwmCVS/fvwmBuildT/fvwm/fvwm# ./fvwm2.3 -d :1 -f ~/.fvwm2rc-Barebo
nes &
[1] 3031
drbob:/bob3/src/WM/FvwmCVS/fvwmBuildT/fvwm/fvwm# malloc of 92 bytes failed. Exiting
    - A total of 14582 bytes has been allocated in 497 calls to safemalloc.
We're going to segfault now, so we can get a stack trace!
drbob:/bob3/src/WM/FvwmCVS/fvwmBuildT/fvwm/fvwm# gdb -se ./fvwm2.3 -c ./core
GDB is free software and you are welcome to distribute copies of it
 under certain conditions; type "show copying" to see the conditions.
There is absolutely no warranty for GDB; type "show warranty" for details.
GDB 4.16 (i486-slackware-linux), Copyright 1996 Free Software Foundation, Inc...
Core was generated by `./fvwm2.3 -d :1 -f /root/.fvwm2rc-Barebones'.
Program terminated with signal 11, Segmentation fault.
Reading symbols from /usr/X11R6/lib/libXpm.so.4...done.
Reading symbols from /usr/X11R6/lib/libSM.so.6...done.
Reading symbols from /usr/X11R6/lib/libICE.so.6...done.
Reading symbols from /usr/X11R6/lib/libXext.so.6...done.
Reading symbols from /usr/X11R6/lib/libX11.so.6...done.
Reading symbols from /usr/i486-linuxlibc5/lib/libc.so.5...done.
Reading symbols from /usr/X11R6/lib/libXintl.so.6...done.
Reading symbols from /lib/ld-linux.so.1...done.
#0  0x808aaf0 in safemalloc (length=92) at safemalloc.c:38
38      *boom2 = 0;
(gdb) bt
#0  0x808aaf0 in safemalloc (length=92) at safemalloc.c:38
#1  0x8076b77 in make_named_packet (len=0xbfffea38, event_type=262144,
    name=0x809b598 "ImagePath /usr/include/X11/pixmaps:/usr/include/X11/bitmaps\n",
    num=3) at module.c:526
#2  0x8076c2f in SendName (module=0, event_type=262144, data1=0, data2=0, data3=0,
    name=0x809b598 "ImagePath /usr/include/X11/pixmaps:/usr/include/X11/bitmaps\n")
    at module.c:553
#3  0x80758ea in SendDataToModule (eventp=0x8092960, w=39, tmp_win=0x0, context=8,
    action=0x809b577 "", Module=0xbfffeb30) at modconf.c:170
#4  0x80652a7 in ExecuteFunction (Action=0xbfffeb44 "Send_ConfigInfo", tmp_win=0x0,
    eventp=0x8092960, context=8, Module=0) at functions.c:320
#5  0x80765b5 in HandleModuleInput (w=0, channel=0) at module.c:375
#6  0x8064731 in My_XNextEvent (dpy=0x80957f0, event=0x8092960) at events.c:1677
#7  0x8061afa in HandleEvents () at events.c:195
#8  0x80671ab in main (argc=5, argv=0xbffff414) at fvwm.c:554
#9  0x804b48e in ___crt_dummy__ ()