[Bug 5892] New: invalid call to free()

http://bugzilla.xfce.org/show_bug.cgi?id=5892

           Summary: invalid call to free()
    Classification: Xfce
           Product: Libxfcegui4
           Version: 4.6.1
          Platform: Other
        OS/Version: Linux
            Status: NEW
          Severity: normal
          Priority: Medium
         Component: General
        AssignedTo: xfce-bugs@...
        ReportedBy: stick@...


I believe I've found a race condition during the first Xfce launch.

When there are no files in user's home directory xfwm4 crashes with these
error:

*** glibc detected *** xfwm4: free(): invalid pointer: 0x080de928 ***
======= Backtrace: =========
/lib/libc.so.6[0xb754c50b]
/lib/libc.so.6(cfree+0xd9)[0xb7551049]
/usr/lib/libglib-2.0.so.0(g_free+0x36)[0xb77e3916]
/usr/lib/libxfce4kbd-private.so.5[0xb7ea22c7]
/usr/lib/libgobject-2.0.so.0(g_object_newv+0x9ca)[0xb787913a]
/usr/lib/libgobject-2.0.so.0(g_object_new_valist+0x34a)[0xb787966a]
/usr/lib/libgobject-2.0.so.0(g_object_new+0x70)[0xb7879780]
/usr/lib/libxfce4kbd-private.so.5(xfce_shortcuts_provider_new+0x36)[0xb7ea1b96]
xfwm4[0x807cceb]
xfwm4[0x806ae93]
/lib/libc.so.6(__libc_start_main+0xfe)[0xb74f5ace]
xfwm4[0x80503e1]

When I run xfwm4 from console it starts and any subsequents Xfce starts are OK
(with xfwm4).

I tracked the problem deeper and the invalid free() call happens here:
http://git.xfce.org/xfce/libxfcegui4/tree/libxfce4kbd-private/xfce-shortcuts-provider.c?id=xfce-4.6.1#n299
(g_free() at line 299)

I'm no GLib expert, so I created a workaround and it works (no xfwm4 crash at
first start) - see attachment. Is the fix OK or it should be fixed in another
way? Thanks!

--
Configure bugmail: http://bugzilla.xfce.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
_______________________________________________
Xfce-bugs mailing list
Xfce-bugs@...
http://foo-projects.org/mailman/listinfo/xfce-bugs

http://bugzilla.xfce.org/show_bug.cgi?id=5892

--- Comment #1 from Pavol Rusnak <stick@...> 2009-10-21 16:12:52 UTC ---
Created an attachment (id=2623)
 --> (http://bugzilla.xfce.org/attachment.cgi?id=2623)
proposed fix

--
Configure bugmail: http://bugzilla.xfce.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
_______________________________________________
Xfce-bugs mailing list
Xfce-bugs@...
http://foo-projects.org/mailman/listinfo/xfce-bugs

http://bugzilla.xfce.org/show_bug.cgi?id=5892

Pavol Rusnak <stick@...> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jannis@...

--
Configure bugmail: http://bugzilla.xfce.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
_______________________________________________
Xfce-bugs mailing list
Xfce-bugs@...
http://foo-projects.org/mailman/listinfo/xfce-bugs

http://bugzilla.xfce.org/show_bug.cgi?id=5892

--- Comment #2 from Pavol Rusnak <stick@...> 2009-10-21 17:41:59 UTC ---
Seems that workaround doesn't work on i586 :-/

--
Configure bugmail: http://bugzilla.xfce.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
_______________________________________________
Xfce-bugs mailing list
Xfce-bugs@...
http://foo-projects.org/mailman/listinfo/xfce-bugs

http://bugzilla.xfce.org/show_bug.cgi?id=5892

Pavol Rusnak <stick@...> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Attachment #2623|0                           |1
        is obsolete|                            |

--- Comment #3 from Pavol Rusnak <stick@...> 2009-10-22 11:46:27 UTC ---
Created an attachment (id=2624)
 --> (http://bugzilla.xfce.org/attachment.cgi?id=2624)
new proposed fix

This patch fixes the problem on both x86 and x86_64.

--
Configure bugmail: http://bugzilla.xfce.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
_______________________________________________
Xfce-bugs mailing list
Xfce-bugs@...
http://foo-projects.org/mailman/listinfo/xfce-bugs

http://bugzilla.xfce.org/show_bug.cgi?id=5892

Pavol Rusnak <stick@...> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           See Also|                            |https://bugzilla.novell.com
                   |                            |/show_bug.cgi?id=530226

--
Configure bugmail: http://bugzilla.xfce.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
_______________________________________________
Xfce-bugs mailing list
Xfce-bugs@...
http://foo-projects.org/mailman/listinfo/xfce-bugs

http://bugzilla.xfce.org/show_bug.cgi?id=5892

Olivier Fourdan <fourdan@...> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |fourdan@...

--- Comment #4 from Olivier Fourdan <fourdan@...> 2009-10-22 13:09:25 UTC ---
What is the rationale behind the fix?

--
Configure bugmail: http://bugzilla.xfce.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
_______________________________________________
Xfce-bugs mailing list
Xfce-bugs@...
http://foo-projects.org/mailman/listinfo/xfce-bugs

http://bugzilla.xfce.org/show_bug.cgi?id=5892

--- Comment #5 from Pavol Rusnak <stick@...> 2009-10-22 13:21:29 UTC ---
This is not a fix, but rather a workaround. I think the code somehow messes
outside of the allocated range and this is detected when freeing the pointer.
Increasing array size prevents the corruption from happening. I would fix the
code on proper place, but was not able to find it :-/

--
Configure bugmail: http://bugzilla.xfce.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
_______________________________________________
Xfce-bugs mailing list
Xfce-bugs@...
http://foo-projects.org/mailman/listinfo/xfce-bugs

http://bugzilla.xfce.org/show_bug.cgi?id=5892

Nick Schermer <nick@...> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |nick@...

--- Comment #6 from Nick Schermer <nick@...> 2009-10-22 15:26:02 CEST ---
+2 should be enough (1 for the appended name and 1 for null terminate).

--
Configure bugmail: http://bugzilla.xfce.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
_______________________________________________
Xfce-bugs mailing list
Xfce-bugs@...
http://foo-projects.org/mailman/listinfo/xfce-bugs

http://bugzilla.xfce.org/show_bug.cgi?id=5892

--- Comment #7 from Pavol Rusnak <stick@...> 2009-10-22 13:30:44 UTC ---
I thought so, but +2 didn't work on my i586 machine (mysteriously it worked on
x86-64). +3 fixes both platforms.

--
Configure bugmail: http://bugzilla.xfce.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
_______________________________________________
Xfce-bugs mailing list
Xfce-bugs@...
http://foo-projects.org/mailman/listinfo/xfce-bugs