This is the mail archive of the
insight@sources.redhat.com
mailing list for the Insight project.
Fix for illegal memory access in itk
- From: Mo DeJong <supermo at bayarea dot net>
- To: sourcenav at sources dot redhat dot com
- Cc: insight at sources dot redhat dot com
- Date: Tue, 26 Feb 2002 12:50:20 -0800
- Subject: Fix for illegal memory access in itk
- Organization: House of Mirth
The following was adapted from Itcl patch 521922 on SF. A detailed description
of what lead up to this patch can be found here:
http://groups.google.com/groups?hl=en&threadm=3C75D7AB.C67D965B%40nospam.com&rnum=1&prev=/groups%3Fq%3DTk_Window%2BMo%2Bgroup:comp.lang.tcl%26hl%3Den%26scoring%3Dr%26selm%3D3C75D7AB.C67D965B%2540nospam.com%26rnum%3D
The patch solves an invalid memory access problem in itk by using a copy
of the window path name. The functionality is the same before and after the
patch, so I think it is safe to apply.
2002-02-26 Mo DeJong <supermo@bayarea.net>
* itk/generic/itk_archetype.c (ArchComponent, Itk_ArchCompDeleteCmd,
Itk_CreateArchComponent, Itk_DelArchComponent): Save a copy
of the window path name in the ArchComponent struct and use
it in the Itk_ArchCompDeleteCmd method. The old code was
invoking Tk_PathName(tkwin) on a Tk_Window which lead to
a memory access on memory that has already been free'd
when the widget was destroyed.
* itk/library/itk.tcl (itk::remove_destroy_hook): Don't attempt
to remove the widget binding if the widget has already been
destroyed.
Index: itk/generic/itk_archetype.c
===================================================================
RCS file: /cvs/src/src/itcl/itk/generic/itk_archetype.c,v
retrieving revision 1.1.1.2
diff -u -r1.1.1.2 itk_archetype.c
--- itk_archetype.c 2001/09/09 19:49:05 1.1.1.2
+++ itk_archetype.c 2002/02/26 20:33:05
@@ -54,6 +54,11 @@
ItclMember *member; /* contains protection level for this comp */
Tcl_Command accessCmd; /* access command for component widget */
Tk_Window tkwin; /* Tk window for this component widget */
+ char *pathName; /* Tk path name for this component widget.
+ We can't use the tkwin pointer after
+ the window has been destroyed so we
+ need to save a copy for use in
+ Itk_ArchCompDeleteCmd() */
} ArchComponent;
/*
@@ -1153,7 +1158,7 @@
*/
Tcl_DStringInit(&buffer);
Tcl_DStringAppend(&buffer, "itk::remove_destroy_hook ", -1);
- Tcl_DStringAppend(&buffer, Tk_PathName(archComp->tkwin), -1);
+ Tcl_DStringAppend(&buffer, archComp->pathName, -1);
(void) Tcl_Eval(interp, Tcl_DStringValue(&buffer));
Tcl_ResetResult(interp);
Tcl_DStringFree(&buffer);
@@ -3171,6 +3176,8 @@
archComp->member = memPtr;
archComp->accessCmd = accessCmd;
archComp->tkwin = tkwin;
+ archComp->pathName = (char *) ckalloc((unsigned)(strlen(wname)+1));
+ strcpy(archComp->pathName, wname);
return archComp;
}
@@ -3189,6 +3196,7 @@
ArchComponent *archComp; /* pointer to component data */
{
ckfree((char*)archComp->member);
+ ckfree((char*)archComp->pathName);
ckfree((char*)archComp);
}
Index: itk/library/itk.tcl
===================================================================
RCS file: /cvs/src/src/itcl/itk/library/itk.tcl,v
retrieving revision 1.1.1.2
diff -u -r1.1.1.2 itk.tcl
--- itk.tcl 2001/09/09 19:49:05 1.1.1.2
+++ itk.tcl 2002/02/26 20:33:05
@@ -37,6 +37,7 @@
# Tcl than C.
# ----------------------------------------------------------------------
proc ::itk::remove_destroy_hook {widget} {
+ if {![winfo exists $widget]} {return}
set tags [bindtags $widget]
set i [lsearch $tags "itk-destroy-$widget"]
if {$i >= 0} {