[Tcl-bugs] [ tktoolkit-Bugs-3053347 ] Invalid read in tkText.c:DumpLine

[SourceForge.net <no...@so...>]

Bugs item #3053347, was opened at 2010-08-25 19:54
Message generated for change (Tracker Item Submitted) made by hobbs
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=112997&aid=3053347&group_id=12997

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: 18. [text]
Group: current: 8.5.8
Status: Open
Resolution: None
Priority: 9
Private: No
Submitted By: Jeffrey Hobbs (hobbs)
Assigned to: Donal K. Fellows (dkf)
Summary: Invalid read in tkText.c:DumpLine

Initial Comment:
I had a crash across platforms in text.test and running under valgrind it indicates:

==9088== Invalid read of size 4
==9088==    at 0x4A7803: DumpLine (tkText.c:4771)
==9088==    by 0x4A6E54: TextDumpCmd (tkText.c:4544)
==9088==    by 0x4A1CE1: TextWidgetObjCmd (tkText.c:1231)
==9088==    by 0x522C28: TclEvalObjvInternal (tclBasic.c:3689)
==9088==    by 0x588D53: TclExecuteByteCode (tclExecute.c:2419)
==9088==    by 0x586741: TclCompEvalObj (tclExecute.c:1542)
==9088==    by 0x52513E: TclEvalObjEx (tclBasic.c:5264)
==9088==    by 0x5E9D54: Tcl_UplevelObjCmd (tclProc.c:948)
==9088==  Address 0x7df3ad8 is 72 bytes inside a block of size 101 free'd
==9088==    at 0x4C23DD8: free (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==9088==    by 0x62D99F: TclpFree (tclAlloc.c:731)
==9088==    by 0x52BBB3: Tcl_DbCkfree (tclCkalloc.c:639)
==9088==    by 0x52BD88: Tcl_Free (tclCkalloc.c:765)
==9088==    by 0x4AE9AA: CharSplitProc (tkTextBTree.c:4559)
==9088==    by 0x4AAECC: SplitSeg (tkTextBTree.c:1210)
==9088==    by 0x4AC0AB: TkBTreeTag (tkTextBTree.c:2211)
==9088==    by 0x4BECCC: TkTextTagCmd (tkTextTag.c:203)
==9088==

It appears that segPtr is no longer valid there, especially since we are in the lineChanged condition.  Donal was the last in this area of code, though it has been a while.

This may also be in head, just was testing 8.5.9 and found this.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=112997&aid=3053347&group_id=12997