From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 5169 invoked by alias); 26 Feb 2002 20:51:41 -0000 Mailing-List: contact sourcenav-help@sources.redhat.com; run by ezmlm Precedence: bulk List-Subscribe: List-Archive: List-Post: List-Help: , Sender: sourcenav-owner@sources.redhat.com Received: (qmail 5093 invoked from network); 26 Feb 2002 20:51:40 -0000 Received: from unknown (HELO shell4.bayarea.net) (209.128.82.1) by sources.redhat.com with SMTP; 26 Feb 2002 20:51:40 -0000 Received: from modrick (209-128-79-218.BAYAREA.NET [209.128.79.218]) by shell4.bayarea.net (8.9.3/8.9.3) with SMTP id MAA01752; Tue, 26 Feb 2002 12:51:39 -0800 (envelope-from supermo@bayarea.net) Date: Tue, 26 Feb 2002 15:25:00 -0000 From: Mo DeJong To: sourcenav@sources.redhat.com Cc: insight@sources.redhat.com Subject: Fix for illegal memory access in itk Message-Id: <20020226125020.5da69f19.supermo@bayarea.net> Organization: House of Mirth X-Mailer: Sylpheed version 0.4.99cvs6 (GTK+ 1.2.7; i686-pc-linux-gnu) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-SW-Source: 2002-q1/txt/msg00136.txt.bz2 The following was adapted from Itcl patch 521922 on SF. A detailed description of what lead up to this patch can be found here: http://groups.google.com/groups?hl=en&threadm=3C75D7AB.C67D965B%40nospam.com&rnum=1&prev=/groups%3Fq%3DTk_Window%2BMo%2Bgroup:comp.lang.tcl%26hl%3Den%26scoring%3Dr%26selm%3D3C75D7AB.C67D965B%2540nospam.com%26rnum%3D The patch solves an invalid memory access problem in itk by using a copy of the window path name. The functionality is the same before and after the patch, so I think it is safe to apply. 2002-02-26 Mo DeJong * itk/generic/itk_archetype.c (ArchComponent, Itk_ArchCompDeleteCmd, Itk_CreateArchComponent, Itk_DelArchComponent): Save a copy of the window path name in the ArchComponent struct and use it in the Itk_ArchCompDeleteCmd method. The old code was invoking Tk_PathName(tkwin) on a Tk_Window which lead to a memory access on memory that has already been free'd when the widget was destroyed. * itk/library/itk.tcl (itk::remove_destroy_hook): Don't attempt to remove the widget binding if the widget has already been destroyed. Index: itk/generic/itk_archetype.c =================================================================== RCS file: /cvs/src/src/itcl/itk/generic/itk_archetype.c,v retrieving revision 1.1.1.2 diff -u -r1.1.1.2 itk_archetype.c --- itk_archetype.c 2001/09/09 19:49:05 1.1.1.2 +++ itk_archetype.c 2002/02/26 20:33:05 @@ -54,6 +54,11 @@ ItclMember *member; /* contains protection level for this comp */ Tcl_Command accessCmd; /* access command for component widget */ Tk_Window tkwin; /* Tk window for this component widget */ + char *pathName; /* Tk path name for this component widget. + We can't use the tkwin pointer after + the window has been destroyed so we + need to save a copy for use in + Itk_ArchCompDeleteCmd() */ } ArchComponent; /* @@ -1153,7 +1158,7 @@ */ Tcl_DStringInit(&buffer); Tcl_DStringAppend(&buffer, "itk::remove_destroy_hook ", -1); - Tcl_DStringAppend(&buffer, Tk_PathName(archComp->tkwin), -1); + Tcl_DStringAppend(&buffer, archComp->pathName, -1); (void) Tcl_Eval(interp, Tcl_DStringValue(&buffer)); Tcl_ResetResult(interp); Tcl_DStringFree(&buffer); @@ -3171,6 +3176,8 @@ archComp->member = memPtr; archComp->accessCmd = accessCmd; archComp->tkwin = tkwin; + archComp->pathName = (char *) ckalloc((unsigned)(strlen(wname)+1)); + strcpy(archComp->pathName, wname); return archComp; } @@ -3189,6 +3196,7 @@ ArchComponent *archComp; /* pointer to component data */ { ckfree((char*)archComp->member); + ckfree((char*)archComp->pathName); ckfree((char*)archComp); } Index: itk/library/itk.tcl =================================================================== RCS file: /cvs/src/src/itcl/itk/library/itk.tcl,v retrieving revision 1.1.1.2 diff -u -r1.1.1.2 itk.tcl --- itk.tcl 2001/09/09 19:49:05 1.1.1.2 +++ itk.tcl 2002/02/26 20:33:05 @@ -37,6 +37,7 @@ # Tcl than C. # ---------------------------------------------------------------------- proc ::itk::remove_destroy_hook {widget} { + if {![winfo exists $widget]} {return} set tags [bindtags $widget] set i [lsearch $tags "itk-destroy-$widget"] if {$i >= 0} {