Dangling pointer access in TGtk2WidgetSet.CombineRgn
Original Reporter info from Mantis: Martin @martin_frb
-
Reporter name: Martin Friebe
Original Reporter info from Mantis: Martin @martin_frb
- Reporter name: Martin Friebe
Description:
Just did a valgrind run of the IDE (startup only) and found this. (see below)
It appears that TGtk2WidgetSet.CombineRgn is doing the following
line 1834
DObj := {%H-}PGdiObject(Dest);
DObj points to Dest
line 1849
RGN_AND :
D := PGDKRegion(gdk_region_intersect(S1, S2));
create a new region
line 1865
if Assigned(DObj^.GDIRegionObject) then
gdk_region_destroy(DObj^.GDIRegionObject);
DObj^.GDIRegionObject := D;
The newly created region is stored as part of DObj/Dest
line 1872
DeleteObject(Dest);
Dest := CreateEmptyRegion;
Result := RegionType(D);
Dest is deleted.
According to the valgrind trace, that also frees "D"
As a result "RegionType" is called with a dangling pointer.
I have not invested more time into this, but I guess it should do if the "Result := RegionType(D);" is moved up 2 lines, before the DeleteObject?
==3401== Invalid read of size 8 ==3401== at 0x52933AB: gdk_region_empty (in /usr/lib64/libgdk-x11-2.0.so.0.2400.32) ==3401== by 0x668E5A: GTK2PROC_$$_REGIONTYPE$PGDKREGION$$LONGINT (gtk2proc.inc:1448) ==3401== by 0x4FB313: GTK2INT$_$TGTK2WIDGETSET_$__$$_COMBINERGN$HRGN$HRGN$HRGN$LONGINT$$LONGINT (gtk2winapi.inc:1874) ==3401== by 0x65DA12: INTERFACEBASE$_$TWIDGETSET_$__$$_RECTVISIBLE$HDC$TRECT$$BOOLEAN (intfbasewinapi.inc:1851) ==3401== by 0x506D10: GTK2INT$_$TGTK2WIDGETSET_$__$$_RECTVISIBLE$HDC$TRECT$$BOOLEAN (gtk2winapi.inc:7339) ==3401== by 0x5BC981: LCLINTF_$$_RECTVISIBLE$HDC$TRECT$$BOOLEAN (winapi.inc:795) ==3401== by 0x59823C: CONTROLS$_$TWINCONTROL_$__$$_PAINTCONTROLS$HDC$TCONTROL (wincontrol.inc:4945) ==3401== by 0x598059: CONTROLS$_$TWINCONTROL_$__$$_PAINTHANDLER$TLMPAINT (wincontrol.inc:4880) ==3401== by 0x59C6C9: CONTROLS$_$TWINCONTROL_$__$$_WMPAINT$TLMPAINT (wincontrol.inc:6850) ==3401== by 0x5B16DB: CONTROLS$_$TCUSTOMCONTROL_$__$$_WMPAINT$TLMPAINT (customcontrol.inc:98) ==3401== by 0x431ADE: SYSTEM$_$TOBJECT_$__$$_DISPATCH$formal (in /home/m/laz/lazgit/lazarus) ==3401== by 0x59951C: CONTROLS$_$TWINCONTROL_$__$$_WNDPROC$TLMESSAGE (wincontrol.inc:5429) ==3401== Address 0xd07aff8 is 8 bytes inside a block of size 40 free'd ==3401== at 0x4C2FDAC: free (vg_replace_malloc.c:530) ==3401== by 0x63BE4D1: g_free (in /usr/lib64/libglib-2.0.so.0.5600.1) ==3401== by 0x63D6723: g_slice_free1 (in /usr/lib64/libglib-2.0.so.0.5600.1) ==3401== by 0x4F576E: GTK2INT$_$TGTK2WIDGETSET_$__$$_RELEASEGDIOBJECT$PGDIOBJECT$$BOOLEAN (gtk2widgetset.inc:5755) ==3401== by 0x4FB3B6: GTK2INT$_$TGTK2WIDGETSET_$__$$_DELETEOBJECT$HGDIOBJ$$BOOLEAN (gtk2winapi.inc:1941) ==3401== by 0x4FB2F5: GTK2INT$_$TGTK2WIDGETSET_$__$$_COMBINERGN$HRGN$HRGN$HRGN$LONGINT$$LONGINT (gtk2winapi.inc:1872) ==3401== by 0x65DA12: INTERFACEBASE$_$TWIDGETSET_$__$$_RECTVISIBLE$HDC$TRECT$$BOOLEAN (intfbasewinapi.inc:1851) ==3401== by 0x506D10: GTK2INT$_$TGTK2WIDGETSET_$__$$_RECTVISIBLE$HDC$TRECT$$BOOLEAN (gtk2winapi.inc:7339) ==3401== by 0x5BC981: LCLINTF_$$_RECTVISIBLE$HDC$TRECT$$BOOLEAN (winapi.inc:795) ==3401== by 0x59823C: CONTROLS$_$TWINCONTROL_$__$$_PAINTCONTROLS$HDC$TCONTROL (wincontrol.inc:4945) ==3401== by 0x598059: CONTROLS$_$TWINCONTROL_$__$$_PAINTHANDLER$TLMPAINT (wincontrol.inc:4880) ==3401== by 0x59C6C9: CONTROLS$_$TWINCONTROL_$__$$_WMPAINT$TLMPAINT (wincontrol.inc:6850) ==3401== Block was alloc'd at ==3401== at 0x4C2EBAB: malloc (vg_replace_malloc.c:299) ==3401== by 0x63BE3C5: g_malloc (in /usr/lib64/libglib-2.0.so.0.5600.1) ==3401== by 0x63D5FF6: g_slice_alloc (in /usr/lib64/libglib-2.0.so.0.5600.1) ==3401== by 0x5292931: gdk_region_new (in /usr/lib64/libgdk-x11-2.0.so.0.2400.32) ==3401== by 0x5292AA6: gdk_region_copy (in /usr/lib64/libgdk-x11-2.0.so.0.2400.32) ==3401== by 0x664FBC: GTK2PROC_$$_GDK_REGION_INTERSECT$PGDKREGION$PGDKREGION$$PGDKREGION (gtk2proc.inc:161) ==3401== by 0x4FB229: GTK2INT$_$TGTK2WIDGETSET_$__$$_COMBINERGN$HRGN$HRGN$HRGN$LONGINT$$LONGINT (gtk2winapi.inc:1849) ==3401== by 0x65DA12: INTERFACEBASE$_$TWIDGETSET_$__$$_RECTVISIBLE$HDC$TRECT$$BOOLEAN (intfbasewinapi.inc:1851) ==3401== by 0x506D10: GTK2INT$_$TGTK2WIDGETSET_$__$$_RECTVISIBLE$HDC$TRECT$$BOOLEAN (gtk2winapi.inc:7339) ==3401== by 0x5BC981: LCLINTF_$$_RECTVISIBLE$HDC$TRECT$$BOOLEAN (winapi.inc:795) ==3401== by 0x59823C: CONTROLS$_$TWINCONTROL_$__$$_PAINTCONTROLS$HDC$TCONTROL (wincontrol.inc:4945) ==3401== by 0x598059: CONTROLS$_$TWINCONTROL_$__$$_PAINTHANDLER$TLMPAINT (wincontrol.inc:4880)
==3401==
Mantis conversion info:
- Mantis ID: 37409
- OS: Fedora
- OS Build: 64 bit
- Build: 63630
- Platform: Linux
- Version: 2.1 (SVN)
- Fixed in revision: 63635 (#b45ee007).