[dev] Re: st: Use after free

From: <moosotc_AT_gmail.com>
Date: Mon, 23 Jan 2017 18:16:51 +0300

moosotc_AT_gmail.com writes:

> `valgrind st -f mono-2 cat full-bmp.txt' [1]
>
> Yields quite a few invalid reads from freed blocks, the issue is related
> to cache management. In the real world those dangling pointer issues
> lead to segfaults or X11 errors (eventually)
>
> [1] http://www.cl.cam.ac.uk/~mgk25/ucs/full-bmp.txt

Following avoids using freed fonts.

diff --git a/st.c b/st.c
index fbcd9e0..667e7af 100644
--- a/st.c
+++ b/st.c
_AT_@ -3783,6 +3783,7 @@ xmakeglyphfontspecs(XftGlyphFontSpec *specs, const Glyph *glyphs, int len, int x
                          */
                         if (frclen >= LEN(frc)) {
                                 frclen = LEN(frc) - 1;
+ specs->font = NULL;
                                 XftFontClose(xw.dpy, frc[frclen].font);
                                 frc[frclen].unicodep = 0;
                         }
_AT_@ -3928,7 +3929,10 @@ xdrawglyphfontspecs(const XftGlyphFontSpec *specs, Glyph base, int len, int x, i
         XftDrawSetClipRectangles(xw.draw, winx, winy, &r, 1);
 
         /* Render the glyphs. */
- XftDrawGlyphFontSpec(xw.draw, fg, specs, len);
+ if (specs->font)
+ XftDrawGlyphFontSpec(xw.draw, fg, specs, len);
+ else
+ fprintf(stderr, "st: nil font\n");
 
         /* Render underline and strikethrough. */
         if (base.mode & ATTR_UNDERLINE) {

-- 
mailto:moosotc_AT_gmail.com
Received on Mon Jan 23 2017 - 16:16:51 CET

This archive was generated by hypermail 2.3.0 : Mon Jan 23 2017 - 16:24:15 CET