Bug 422981 - A signal handler can destroy uninitialized object
Summary: A signal handler can destroy uninitialized object
Keywords:
Status: CLOSED DUPLICATE of bug 246129
Alias: None
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: scim
Version: 5.0
Hardware: All
OS: Linux
low
low
Target Milestone: ---
: ---
Assignee: Jens Petersen
QA Contact: QE Internationalization Bugs
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2007-12-13 08:56 UTC by Masatake YAMATO
Modified: 2010-10-18 17:00 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2007-12-14 06:13:29 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)
A patch fixing the issue. (667 bytes, patch)
2007-12-13 08:56 UTC, Masatake YAMATO
no flags Details | Diff

Description Masatake YAMATO 2007-12-13 08:56:15 UTC
Description of problem:

I couldn't the way to reproduce the problem in my hand but
during the code reviewing on scim, I found lines potentially causing a bug.

scim-panel-gtk sets a signal which destroys _panel_agent object.  This
itself is o.k. However, when setting the handler, the object is not
initizlied. This is a bit dangerous: if a signal is received before
initializing the object, the signal handler may run the detructor on
uninitialized object.

The signal handler should check the object is initizlied or not 
before running the destructor.

Version-Release number of selected component (if applicable):

scim-1.4.4-20060716

How reproducible:

By reading source code, sorry.

Steps to Reproduce:
1.
2.
3.
  
Actual results:


Expected results:


Additional info:


See scim-1.4.4-20060716/extras/panel/scim_panel_gtk.cpp:
------------------------------------------------------------------------
    signal(SIGQUIT, signalhandler);
    signal(SIGTERM, signalhandler);
    signal(SIGINT,  signalhandler);
    signal(SIGHUP,  signalhandler);

    gtk_init (&new_argc, &new_argv);

    ui_initialize ();

    // get current display.
    {
#if GDK_MULTIHEAD_SAFE
        const char *p = gdk_display_get_name (gdk_display_get_default ());
#else
        const char *p = getenv ("DISPLAY");
#endif
        if (p) display_name = String (p);
    }

    if (!initialize_panel_agent (config_name, display_name, should_resident)) {

------------------------------------------------------------------------

signalhandler calls "stop" method of _panel_agent. 
Howerver, _panel_agent is NULL unitil initialize_panel_agent
function is called. (I called this stop method "destructor" in 
the above description of  problem.)

Comment 1 Masatake YAMATO 2007-12-13 08:56:15 UTC
Created attachment 286991 [details]
A patch fixing the issue.

Comment 2 Peng Huang 2007-12-14 06:13:29 UTC

*** This bug has been marked as a duplicate of 246129 ***

Comment 3 Jens Petersen 2008-02-07 01:30:23 UTC
Thanks, Yamato-san, for this valuable information.


Note You need to log in before you can comment on or make changes to this bug.