Bug 31618 - XFree86 4.0.2-9 dereferences freed memory when switching Text widget focus
XFree86 4.0.2-9 dereferences freed memory when switching Text widget focus
Product: Red Hat Linux
Classification: Retired
Component: XFree86 (Show other bugs)
i386 Linux
medium Severity medium
: ---
: ---
Assigned To: Mike A. Harris
David Lawrence
Depends On:
  Show dependency treegraph
Reported: 2001-03-12 22:23 EST by Jonathan Kamens
Modified: 2007-04-18 12:32 EDT (History)
0 users

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2001-06-07 10:46:56 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
Patch to fix this bug (you may want to clean it up a little, but this is the general idea, and it works) (863 bytes, patch)
2001-03-12 22:23 EST, Jonathan Kamens
no flags Details | Diff
Patch to fix this bug in XFree86-4.0.3-3.src.rpm (498 bytes, patch)
2001-03-26 10:52 EST, Jonathan Kamens
no flags Details | Diff

  None (edit)
Description Jonathan Kamens 2001-03-12 22:23:01 EST
There is code in a patch included in XFree86-4.0.2-9 to automatically keep
track of which Text widget on each display has focus so that the block
cursor is only displayed in the correct widget.

Unfortunately, this code will dereference freed memory if the Text widget
with focus is destroyed and then a new one is created and given focus.

I will attach a patch to fix this problem.

I am not submitting this patch to the XFree86 maintainers, since it is a
patch to code which is apparently specific to RedHat.  You should merge
this patch with your code and submit all of it to the XFree86 maintainers.
Comment 1 Jonathan Kamens 2001-03-12 22:23:39 EST
Created attachment 12542 [details]
Patch to fix this bug (you may want to clean it up a little, but this is the general idea, and it works)
Comment 2 Jonathan Kamens 2001-03-26 10:52:17 EST
The fix for this in the XFree86-4.0.3-3 RPM is insufficient.  Even with that
fix, freed memory will still be referenced if a text widget loses focus and is
destroyed before another text widget gets focus.  I will attach a patch.
Comment 3 Jonathan Kamens 2001-03-26 10:52:53 EST
Created attachment 13683 [details]
Patch to fix this bug in XFree86-4.0.3-3.src.rpm
Comment 4 Mike A. Harris 2001-03-26 23:58:19 EST
Patch applied.  Will appear in 4.0.3-4 in rawhide.  Also sent upstream
to be applied to stable branch and trunk.
Comment 5 Mike A. Harris 2001-03-27 00:09:41 EST
Spoke too soon.  Patch fails...  You've got 2 patches above, and the first one
fails to apply cleanly.  It looks like the XFree86 code has changed in this
area of code, perhaps implementing a different solution from what it appears
to me.  Is the second patch you sent intended to obsolete the first?

Right now I just concatenated both patches, but I'm backing it back out
for now.  Should I disregard the first patch then and just apply the 2nd
patch?  Please respond ASAP.
Comment 6 Mike A. Harris 2001-03-27 00:13:55 EST
Also, I just noticed in your first message above you say this code is
specific to Red Hat Linux however there are no Red Hat patches being applied
to any of these files, so any bug found is not Red Hat Linux specific IMHO.
I will send the patch upstream once we figure out what to apply though.

Thanks, TTYL
Comment 7 Mike A. Harris 2001-03-27 03:06:16 EST
Ok, I've looked through it a bit and I believe the second patch is
all that is needed, and i've applied it, so I'm closing this one.  If
any other patch needs to go with this - which it doesn't appear to -
please reopen the bug and attach a patch nd I'll add it ASAP.

Comment 8 Jonathan Kamens 2001-06-07 10:46:53 EDT
This behavior has reverted in XFree86-4.1.0-0.0.2.  The second patch I submitted
in this bug has disappeared and needs to be put back.  I'm seeing segfaults
again because of this.

Comment 9 Mike A. Harris 2001-06-18 07:32:00 EDT
The perils of maintaining too many simultaneous XFree86 releases is that
sometimes a patch gets lost..  ;o(  Fixed.

Note You need to log in before you can comment on or make changes to this bug.