Bug lib panel

[Thibault Fresnet]

It seems that there is a bug that causes a segfault when adding and removing a panel multiples times (i haven't tried to refresh the panel stack).

Here is the source code : http://pastebin.com/e5t0JtYf

-- 

Thibault Fresnet (aka Sildra)

<sildra.fr@...>

EPITA 2015 - SPE C2

_______________________________________________
Bug-ncurses mailing list
Bug-ncurses@...
https://lists.gnu.org/mailman/listinfo/bug-ncurses

[Thomas Dickey-2]

On Fri, Jul 27, 2012 at 02:27:37PM +0200, Thibault Fresnet wrote:
> It seems that there is a bug that causes a segfault when adding and
> removing a panel multiples times (i haven't tried to refresh the panel
> stack).
> Here is the source code : http://pastebin.com/e5t0JtYf

According to your example, the problem is that the window referenced by
the panel is freed before the panel is freed.

The documentation doesn't say much on this area:

       del_panel(pan)
              removes the given panel from  the   stack  and  deallocates  the
              PANEL structure (but not its associated window).

however, deleting a panel will cause the library to repaint the screen.
That requires knowing which windows are valid.  valgrind shows this:

==4793== Invalid read of size 2
==4793==    at 0x4027CC6: _nc_dPanel (in /usr/local/ncurses/lib/libpanel.so.5.9)
==4793==    by 0x4027DFE: _nc_Touchpan (in /usr/local/ncurses/lib/libpanel.so.5.9)
==4793==    by 0x40284F8: del_panel (in /usr/local/ncurses/lib/libpanel.so.5.9)
==4793==    by 0x8048780: del (test.c:53)
==4793==    by 0x804871D: main (test.c:39)
==4793==  Address 0x41ce8e2 is 18 bytes inside a block of size 84 free'd
==4793==    at 0x4022B8A: free (vg_replace_malloc.c:323)
==4793==    by 0x4045309: _nc_freewin (in /usr/local/ncurses/lib/libncurses.so.5.9)
==4793==    by 0x403B41C: delwin (in /usr/local/ncurses/lib/libncurses.so.5.9)
==4793==    by 0x8048770: del (test.c:52)
==4793==    by 0x804871D: main (test.c:39)

I see that you've already found this:

    delwin((*list)->window); //this one must not occur before
    del_panel((*list)->panel); // this one.

It would be nice to do a sanity-check on each pointer.  But bear in mind
that having deleted the panel's window, each panel function stops working
since they all (or most) do something to repaint the screen.

I'll make a to-do item to extend the panelhook to address this.

--
Thomas E. Dickey <dickey@...>
http://invisible-island.net
ftp://invisible-island.net


_______________________________________________
Bug-ncurses mailing list
Bug-ncurses@...
https://lists.gnu.org/mailman/listinfo/bug-ncurses