Fix for illegal memory access in itk

[Mo DeJong <supermo@bayarea.net>]

The following was adapted from Itcl patch 521922 on SF. A detailed description
of what lead up to this patch can be found here:

http://groups.google.com/groups?hl=en&threadm=3C75D7AB.C67D965B%40nospam.com&rnum=1&prev=/groups%3Fq%3DTk_Window%2BMo%2Bgroup:comp.lang.tcl%26hl%3Den%26scoring%3Dr%26selm%3D3C75D7AB.C67D965B%2540nospam.com%26rnum%3D

The patch solves an invalid memory access problem in itk by using a copy
of the window path name. The functionality is the same before and after the
patch, so I think it is safe to apply.

2002-02-26  Mo DeJong  <supermo@bayarea.net>

	* itk/generic/itk_archetype.c (ArchComponent, Itk_ArchCompDeleteCmd,
	Itk_CreateArchComponent, Itk_DelArchComponent): Save a copy
	of the window path name in the ArchComponent struct and use
	it in the Itk_ArchCompDeleteCmd method. The old code was
	invoking Tk_PathName(tkwin) on a Tk_Window which lead to
	a memory access on memory that has already been free'd
	when the widget was destroyed.
	* itk/library/itk.tcl (itk::remove_destroy_hook): Don't attempt
	to remove the widget binding if the widget has already been
	destroyed.

Index: itk/generic/itk_archetype.c
===================================================================
RCS file: /cvs/src/src/itcl/itk/generic/itk_archetype.c,v
retrieving revision 1.1.1.2
diff -u -r1.1.1.2 itk_archetype.c
--- itk_archetype.c	2001/09/09 19:49:05	1.1.1.2
+++ itk_archetype.c	2002/02/26 20:33:05
@@ -54,6 +54,11 @@
     ItclMember *member;         /* contains protection level for this comp */
     Tcl_Command accessCmd;      /* access command for component widget */
     Tk_Window tkwin;            /* Tk window for this component widget */
+    char *pathName;             /* Tk path name for this component widget.
+                                   We can't use the tkwin pointer after
+                                   the window has been destroyed so we
+                                   need to save a copy for use in
+                                   Itk_ArchCompDeleteCmd() */
 } ArchComponent;
 
 /*
@@ -1153,7 +1158,7 @@
         */
         Tcl_DStringInit(&buffer);
         Tcl_DStringAppend(&buffer, "itk::remove_destroy_hook ", -1);
-        Tcl_DStringAppend(&buffer, Tk_PathName(archComp->tkwin), -1);
+        Tcl_DStringAppend(&buffer, archComp->pathName, -1);
         (void) Tcl_Eval(interp, Tcl_DStringValue(&buffer));
         Tcl_ResetResult(interp);
         Tcl_DStringFree(&buffer);
@@ -3171,6 +3176,8 @@
     archComp->member     = memPtr;
     archComp->accessCmd  = accessCmd;
     archComp->tkwin      = tkwin;
+    archComp->pathName   = (char *) ckalloc((unsigned)(strlen(wname)+1));
+    strcpy(archComp->pathName, wname);
 
     return archComp;
 }
@@ -3189,6 +3196,7 @@
     ArchComponent *archComp;  /* pointer to component data */
 {
     ckfree((char*)archComp->member);
+    ckfree((char*)archComp->pathName);
     ckfree((char*)archComp);
 }
 
Index: itk/library/itk.tcl
===================================================================
RCS file: /cvs/src/src/itcl/itk/library/itk.tcl,v
retrieving revision 1.1.1.2
diff -u -r1.1.1.2 itk.tcl
--- itk.tcl	2001/09/09 19:49:05	1.1.1.2
+++ itk.tcl	2002/02/26 20:33:05
@@ -37,6 +37,7 @@
 #  Tcl than C.
 # ----------------------------------------------------------------------
 proc ::itk::remove_destroy_hook {widget} {
+    if {![winfo exists $widget]} {return}
     set tags [bindtags $widget]
     set i [lsearch $tags "itk-destroy-$widget"]
     if {$i >= 0} {