[7113] in Athena Bugs
xmh will segv in RemoveMsgConfirmed if opened multiple times for same window
daemon@ATHENA.MIT.EDU (daemon@ATHENA.MIT.EDU)
Thu Feb 14 18:22:50 1991
From: epeisach@ATHENA.MIT.EDU
Date: Thu, 14 Feb 91 18:22:33 -0500
To: xbugs@expo.lcs.mit.edu
Cc: bugs@ATHENA.MIT.EDU, geer@ATHENA.MIT.EDU
X Window System Bug Report
xbugs@expo.lcs.mit.edu
VERSION:
R4+fix-trackers
CLIENT MACHINE and OPERATING SYSTEM:
[e.g. Sun 3/280 running SunOS 4.0.3, Microvax II running Ultrix 3.1, ...]
VAXstation 3100 running BSD 4.3
DECstation 3100 running ultrix 4.0
DISPLAY TYPE:
NA
WINDOW MANAGER:
NA
AREA:
xmh
SYNOPSIS:
If you create a reply window and click twice on close without
sending mail, xmh will pop up two confirmation boxes. Clicking yes on
both will cause xmh to crash.
DESCRIPTION:
xmh pops up two confirmation dialog widgets. Confirming one
destroys the data associated with the screen in RemoveMsgConfirmed() which
causes the second invocation to NULL pointer deref and boom.
REPEAT BY:
1: select a message
2: Press reply
3: make mods to the resulting comp/repl window
4: Press close ( a window pops up asking to confirm)
5: Press close (another window will pop up)
6: Confirm in the top pop up. (repl window goes away)
7: Confirm in other pop up.
8: Look at wonderful core dump!
SAMPLE FIX:
[preferred, but not necessary. Please send context diffs (diff -c -b)]
*** /tmp/,RCSt1023609 Thu Feb 14 18:21:59 1991
--- msg.c Thu Feb 14 18:00:28 1991
***************
*** 278,294 ****
--- 278,298 ----
Arg args[1];
XtSetArg(args[0], XtNtranslations, scrn->read_translations);
XtSetValues(scrn->viewwidget, args, (Cardinal) 1);
}
+ if(scrn->msg) {
scrn->msg->scrn[0] = NULL;
scrn->msg->num_scrns = 0;
+ }
XawTextSetSource(scrn->viewwidget, PNullSource, (XawTextPosition) 0);
+ if(scrn->msg) {
XtDestroyWidget(scrn->msg->source);
scrn->msg->source = NULL;
if (scrn->msg->temporary) {
(void) unlink(MsgFileName(scrn->msg));
TocRemoveMsg(scrn->msg->toc, scrn->msg);
MsgFree(scrn->msg);
+ }
}
}
