Red Hat Bugzilla – Bug 31618
XFree86 4.0.2-9 dereferences freed memory when switching Text widget focus
Last modified: 2007-04-18 12:32:08 EDT
There is code in a patch included in XFree86-4.0.2-9 to automatically keep
track of which Text widget on each display has focus so that the block
cursor is only displayed in the correct widget.
Unfortunately, this code will dereference freed memory if the Text widget
with focus is destroyed and then a new one is created and given focus.
I will attach a patch to fix this problem.
I am not submitting this patch to the XFree86 maintainers, since it is a
patch to code which is apparently specific to RedHat. You should merge
this patch with your code and submit all of it to the XFree86 maintainers.
Created attachment 12542 [details]
Patch to fix this bug (you may want to clean it up a little, but this is the general idea, and it works)
The fix for this in the XFree86-4.0.3-3 RPM is insufficient. Even with that
fix, freed memory will still be referenced if a text widget loses focus and is
destroyed before another text widget gets focus. I will attach a patch.
Created attachment 13683 [details]
Patch to fix this bug in XFree86-4.0.3-3.src.rpm
Patch applied. Will appear in 4.0.3-4 in rawhide. Also sent upstream
to be applied to stable branch and trunk.
Spoke too soon. Patch fails... You've got 2 patches above, and the first one
fails to apply cleanly. It looks like the XFree86 code has changed in this
area of code, perhaps implementing a different solution from what it appears
to me. Is the second patch you sent intended to obsolete the first?
Right now I just concatenated both patches, but I'm backing it back out
for now. Should I disregard the first patch then and just apply the 2nd
patch? Please respond ASAP.
Also, I just noticed in your first message above you say this code is
specific to Red Hat Linux however there are no Red Hat patches being applied
to any of these files, so any bug found is not Red Hat Linux specific IMHO.
I will send the patch upstream once we figure out what to apply though.
Ok, I've looked through it a bit and I believe the second patch is
all that is needed, and i've applied it, so I'm closing this one. If
any other patch needs to go with this - which it doesn't appear to -
please reopen the bug and attach a patch nd I'll add it ASAP.
This behavior has reverted in XFree86-4.1.0-0.0.2. The second patch I submitted
in this bug has disappeared and needs to be put back. I'm seeing segfaults
again because of this.
The perils of maintaining too many simultaneous XFree86 releases is that
sometimes a patch gets lost.. ;o( Fixed.