GNOME Bugzilla – Bug 393312
libsmooth.so corrupts memory
Last modified: 2007-02-22 14:20:52 UTC
Hi, under some circumstances, libsmooth corrupts memory. With help from users, I managed to get a reproduceable test case. a) get Claws-Mail (or Sylpheed-Claws) b) get the to-be-attached gtkrc-smooth-crash file and include it in ~/.gtkrc-2.0 (this file is shipped as /usr/share/themes/Glider/gtk-2.0/gtkrc from the gnome-themes package version 2.14.3 (this file is different in 2.16.1 and doesn't trigger the crash) c) run claws-mail, crash ensue. I'll attach a excerpt from the valgrind report, the gtkrc-smooth-crash gtkrc file and a test patch, which I'm sure is broken, but at least silences valgrind.
Created attachment 79487 [details] gtkrc file triggering the crash
Created attachment 79488 [details] valgrind log
Created attachment 79489 [details] [review] fix patch, probably wrong
Other reports of this bug: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=346174 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=359985 http://forums.gentoo.org/viewtopic-t-522152-highlight-claws.html
Hm, looks like this is caused by the leakfix I did a few months ago part of the following commit. This commit added the g_free which is causing a double free somehow. I wonder why the pointer is not NULL if the data has been freed earlier. 2006-11-10 Benjamin Berg <benjamin@sipsolutions.net> * engines/clearlooks/src/clearlooks_style.c: (clearlooks_style_draw_flat_box): - possible crash bug * engines/smooth/src/engine/shared/gtk/smooth_gtk_rc.c: (smooth_arrow_merge): - fix a leak that happend when rc styles were merged
I think the memcpy is the problem. It does not only copy all the options, but also the pointer to the arrow. As the arrow does not have any refcounting or similar, we need to create a new one and copy its data seperatly.
Benjamin: That's what I thought too, but got lost trying to fix it correctly. Two things are dangerous in that function imho: -g_free()ing a struct member and not setting it to NULL afterwards -memcpy()ing a struct that contains pointers to dynamically allocated stuff
Created attachment 80233 [details] [review] Patch to fix this This patch seems to fix things up.
Benjamin, I confirm that your patch in Comment #8 fixes the crash for me.
Thanks for testing it. I commited the patch to both 2-8 and HEAD.
*** Bug 410667 has been marked as a duplicate of this bug. ***