public inbox for
 help / color / mirror / Atom feed
From: Mo DeJong <>
Subject: Fix for illegal memory access in itk
Date: Tue, 26 Feb 2002 15:25:00 -0000	[thread overview]
Message-ID: <> (raw)

The following was adapted from Itcl patch 521922 on SF. A detailed description
of what lead up to this patch can be found here:

The patch solves an invalid memory access problem in itk by using a copy
of the window path name. The functionality is the same before and after the
patch, so I think it is safe to apply.

2002-02-26  Mo DeJong  <>

	* itk/generic/itk_archetype.c (ArchComponent, Itk_ArchCompDeleteCmd,
	Itk_CreateArchComponent, Itk_DelArchComponent): Save a copy
	of the window path name in the ArchComponent struct and use
	it in the Itk_ArchCompDeleteCmd method. The old code was
	invoking Tk_PathName(tkwin) on a Tk_Window which lead to
	a memory access on memory that has already been free'd
	when the widget was destroyed.
	* itk/library/itk.tcl (itk::remove_destroy_hook): Don't attempt
	to remove the widget binding if the widget has already been

Index: itk/generic/itk_archetype.c
RCS file: /cvs/src/src/itcl/itk/generic/itk_archetype.c,v
retrieving revision
diff -u -r1.1.1.2 itk_archetype.c
--- itk_archetype.c	2001/09/09 19:49:05
+++ itk_archetype.c	2002/02/26 20:33:05
@@ -54,6 +54,11 @@
     ItclMember *member;         /* contains protection level for this comp */
     Tcl_Command accessCmd;      /* access command for component widget */
     Tk_Window tkwin;            /* Tk window for this component widget */
+    char *pathName;             /* Tk path name for this component widget.
+                                   We can't use the tkwin pointer after
+                                   the window has been destroyed so we
+                                   need to save a copy for use in
+                                   Itk_ArchCompDeleteCmd() */
 } ArchComponent;
@@ -1153,7 +1158,7 @@
         Tcl_DStringAppend(&buffer, "itk::remove_destroy_hook ", -1);
-        Tcl_DStringAppend(&buffer, Tk_PathName(archComp->tkwin), -1);
+        Tcl_DStringAppend(&buffer, archComp->pathName, -1);
         (void) Tcl_Eval(interp, Tcl_DStringValue(&buffer));
@@ -3171,6 +3176,8 @@
     archComp->member     = memPtr;
     archComp->accessCmd  = accessCmd;
     archComp->tkwin      = tkwin;
+    archComp->pathName   = (char *) ckalloc((unsigned)(strlen(wname)+1));
+    strcpy(archComp->pathName, wname);
     return archComp;
@@ -3189,6 +3196,7 @@
     ArchComponent *archComp;  /* pointer to component data */
+    ckfree((char*)archComp->pathName);
Index: itk/library/itk.tcl
RCS file: /cvs/src/src/itcl/itk/library/itk.tcl,v
retrieving revision
diff -u -r1.1.1.2 itk.tcl
--- itk.tcl	2001/09/09 19:49:05
+++ itk.tcl	2002/02/26 20:33:05
@@ -37,6 +37,7 @@
 #  Tcl than C.
 # ----------------------------------------------------------------------
 proc ::itk::remove_destroy_hook {widget} {
+    if {![winfo exists $widget]} {return}
     set tags [bindtags $widget]
     set i [lsearch $tags "itk-destroy-$widget"]
     if {$i >= 0} {

                 reply	other threads:[~2002-02-26 20:51 UTC|newest]

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).