[dev] Re: st: Use after free

From: <moosotc_AT_gmail.com>
Date: Mon, 23 Jan 2017 07:11:09 +0300

moosotc_AT_gmail.com writes:

> `valgrind st -f mono-2 cat full-bmp.txt' [1]
>
> Yields quite a few invalid reads from freed blocks, the issue is related
> to cache management. In the real world those dangling pointer issues
> lead to segfaults or X11 errors (eventually)
>
> [1] http://www.cl.cam.ac.uk/~mgk25/ucs/full-bmp.txt

What I believe happens is this:

in xmakeglyphfontspecs
                        if (frclen >= LEN(frc)) {
                                 frclen = LEN(frc) - 1;
                                XftFontClose(xw.dpy, frc[frclen].font);
                                frc[frclen].unicodep = 0;
                        }

but the font can be current in dc, and somehow xdrawglyphfontspecs uses
freshly freed font.

-- 
mailto:moosotc_AT_gmail.com
Received on Mon Jan 23 2017 - 05:11:09 CET

This archive was generated by hypermail 2.3.0 : Mon Jan 23 2017 - 05:12:13 CET