View Issue Details

IDProjectCategoryView StatusLast Update
0037409LazarusWidgetsetpublic2020-07-25 09:24
ReporterMartin Friebe Assigned ToMattias Gaertner  
PrioritynormalSeverityminorReproducibilityalways
Status resolvedResolutionfixed 
PlatformLinuxOSFedora 
Product Version2.1 (SVN) 
Summary0037409: Dangling pointer access in TGtk2WidgetSet.CombineRgn
DescriptionJust did a valgrind run of the IDE (startup only) and found this. (see below)

It appears that TGtk2WidgetSet.CombineRgn is doing the following

line 1834
  DObj := {%H-}PGdiObject(Dest);
DObj points to Dest

line 1849
      RGN_AND :
        D := PGDKRegion(gdk_region_intersect(S1, S2));
create a new region

line 1865
    if Assigned(DObj^.GDIRegionObject) then
      gdk_region_destroy(DObj^.GDIRegionObject);
    DObj^.GDIRegionObject := D;
The newly created region is stored as part of DObj/Dest

line 1872
      DeleteObject(Dest);
      Dest := CreateEmptyRegion;
      Result := RegionType(D);
Dest is deleted.
According to the valgrind trace, that also frees "D"

As a result "RegionType" is called with a dangling pointer.


I have not invested more time into this, but I guess it should do if the "Result := RegionType(D);" is moved up 2 lines, before the DeleteObject?



==3401== Invalid read of size 8
==3401== at 0x52933AB: gdk_region_empty (in /usr/lib64/libgdk-x11-2.0.so.0.2400.32)
==3401== by 0x668E5A: GTK2PROC_$$_REGIONTYPE$PGDKREGION$$LONGINT (gtk2proc.inc:1448)
==3401== by 0x4FB313: GTK2INT$_$TGTK2WIDGETSET_$__$$_COMBINERGN$HRGN$HRGN$HRGN$LONGINT$$LONGINT (gtk2winapi.inc:1874)
==3401== by 0x65DA12: INTERFACEBASE$_$TWIDGETSET_$__$$_RECTVISIBLE$HDC$TRECT$$BOOLEAN (intfbasewinapi.inc:1851)
==3401== by 0x506D10: GTK2INT$_$TGTK2WIDGETSET_$__$$_RECTVISIBLE$HDC$TRECT$$BOOLEAN (gtk2winapi.inc:7339)
==3401== by 0x5BC981: LCLINTF_$$_RECTVISIBLE$HDC$TRECT$$BOOLEAN (winapi.inc:795)
==3401== by 0x59823C: CONTROLS$_$TWINCONTROL_$__$$_PAINTCONTROLS$HDC$TCONTROL (wincontrol.inc:4945)
==3401== by 0x598059: CONTROLS$_$TWINCONTROL_$__$$_PAINTHANDLER$TLMPAINT (wincontrol.inc:4880)
==3401== by 0x59C6C9: CONTROLS$_$TWINCONTROL_$__$$_WMPAINT$TLMPAINT (wincontrol.inc:6850)
==3401== by 0x5B16DB: CONTROLS$_$TCUSTOMCONTROL_$__$$_WMPAINT$TLMPAINT (customcontrol.inc:98)
==3401== by 0x431ADE: SYSTEM$_$TOBJECT_$__$$_DISPATCH$formal (in /home/m/laz/lazgit/lazarus)
==3401== by 0x59951C: CONTROLS$_$TWINCONTROL_$__$$_WNDPROC$TLMESSAGE (wincontrol.inc:5429)
==3401== Address 0xd07aff8 is 8 bytes inside a block of size 40 free'd
==3401== at 0x4C2FDAC: free (vg_replace_malloc.c:530)
==3401== by 0x63BE4D1: g_free (in /usr/lib64/libglib-2.0.so.0.5600.1)
==3401== by 0x63D6723: g_slice_free1 (in /usr/lib64/libglib-2.0.so.0.5600.1)
==3401== by 0x4F576E: GTK2INT$_$TGTK2WIDGETSET_$__$$_RELEASEGDIOBJECT$PGDIOBJECT$$BOOLEAN (gtk2widgetset.inc:5755)
==3401== by 0x4FB3B6: GTK2INT$_$TGTK2WIDGETSET_$__$$_DELETEOBJECT$HGDIOBJ$$BOOLEAN (gtk2winapi.inc:1941)
==3401== by 0x4FB2F5: GTK2INT$_$TGTK2WIDGETSET_$__$$_COMBINERGN$HRGN$HRGN$HRGN$LONGINT$$LONGINT (gtk2winapi.inc:1872)
==3401== by 0x65DA12: INTERFACEBASE$_$TWIDGETSET_$__$$_RECTVISIBLE$HDC$TRECT$$BOOLEAN (intfbasewinapi.inc:1851)
==3401== by 0x506D10: GTK2INT$_$TGTK2WIDGETSET_$__$$_RECTVISIBLE$HDC$TRECT$$BOOLEAN (gtk2winapi.inc:7339)
==3401== by 0x5BC981: LCLINTF_$$_RECTVISIBLE$HDC$TRECT$$BOOLEAN (winapi.inc:795)
==3401== by 0x59823C: CONTROLS$_$TWINCONTROL_$__$$_PAINTCONTROLS$HDC$TCONTROL (wincontrol.inc:4945)
==3401== by 0x598059: CONTROLS$_$TWINCONTROL_$__$$_PAINTHANDLER$TLMPAINT (wincontrol.inc:4880)
==3401== by 0x59C6C9: CONTROLS$_$TWINCONTROL_$__$$_WMPAINT$TLMPAINT (wincontrol.inc:6850)
==3401== Block was alloc'd at
==3401== at 0x4C2EBAB: malloc (vg_replace_malloc.c:299)
==3401== by 0x63BE3C5: g_malloc (in /usr/lib64/libglib-2.0.so.0.5600.1)
==3401== by 0x63D5FF6: g_slice_alloc (in /usr/lib64/libglib-2.0.so.0.5600.1)
==3401== by 0x5292931: gdk_region_new (in /usr/lib64/libgdk-x11-2.0.so.0.2400.32)
==3401== by 0x5292AA6: gdk_region_copy (in /usr/lib64/libgdk-x11-2.0.so.0.2400.32)
==3401== by 0x664FBC: GTK2PROC_$$_GDK_REGION_INTERSECT$PGDKREGION$PGDKREGION$$PGDKREGION (gtk2proc.inc:161)
==3401== by 0x4FB229: GTK2INT$_$TGTK2WIDGETSET_$__$$_COMBINERGN$HRGN$HRGN$HRGN$LONGINT$$LONGINT (gtk2winapi.inc:1849)
==3401== by 0x65DA12: INTERFACEBASE$_$TWIDGETSET_$__$$_RECTVISIBLE$HDC$TRECT$$BOOLEAN (intfbasewinapi.inc:1851)
==3401== by 0x506D10: GTK2INT$_$TGTK2WIDGETSET_$__$$_RECTVISIBLE$HDC$TRECT$$BOOLEAN (gtk2winapi.inc:7339)
==3401== by 0x5BC981: LCLINTF_$$_RECTVISIBLE$HDC$TRECT$$BOOLEAN (winapi.inc:795)
==3401== by 0x59823C: CONTROLS$_$TWINCONTROL_$__$$_PAINTCONTROLS$HDC$TCONTROL (wincontrol.inc:4945)
==3401== by 0x598059: CONTROLS$_$TWINCONTROL_$__$$_PAINTHANDLER$TLMPAINT (wincontrol.inc:4880)
==3401==
TagsNo tags attached.
Fixed in Revision63635.
LazTarget-
WidgetsetGTK 2
Attached Files

Relationships

related to 0037219 closedJuha Manninen GTK2: TextRect and regions 

Activities

There are no notes attached to this issue.

Issue History

Date Modified Username Field Change
2020-07-23 12:36 Martin Friebe New Issue
2020-07-23 18:27 Mattias Gaertner Assigned To => Mattias Gaertner
2020-07-23 18:27 Mattias Gaertner Status new => resolved
2020-07-23 18:27 Mattias Gaertner Resolution open => fixed
2020-07-23 18:27 Mattias Gaertner Fixed in Revision => 63635.
2020-07-23 18:27 Mattias Gaertner LazTarget => -
2020-07-23 18:27 Mattias Gaertner Widgetset GTK 2 => GTK 2
2020-07-25 09:24 Juha Manninen Relationship added related to 0037219