Tk Source Code

Artifact [cc5ceef6]
Login

Artifact cc5ceef6064ac3d56e694cecf2d221ad5935afa2ef898054bc26c2729b6dd12f:

Ticket change [cc5ceef6] - New ticket [40e4bf61] Entry: double free when textvariable set in validatecommand script. by chrstphrchvz 2020-05-22 12:12:47.
D 2020-05-22T12:12:47.825
J assignee nobody
J closer nobody
J cmimetype text/x-fossil-wiki
J comment Here\sis\sa\sdouble\sfree\sbug\sthat\ssomeone\soriginally\sreported\sfor\sPerl/Tk\s([https://rt.cpan.org/Public/Bug/Display.html?id=102648]),\sbut\swhich\sI\sreplicated\sin\sTcl/Tk\susing\sboth\sthe\soriginal\sPerl/Tk\sexample\sthrough\sTcl::pTk,\sas\swell\sas\sa\snearly\sequivalent\sTcl\ssyntax\sexample:\r\n\r\n<pre>\r\npackage\srequire\sTk\r\n\r\nset\sen_text\s{Type\s'A'\shere}\r\npack\s[entry\s.e\s\\\r\n\s\s\s\s-textvariable\sen_text\s\\\r\n\s\s\s\s-validate\skey\s\\\r\n\s\s\s\s-validatecommand\s{\r\n\s\s\s\s\s\s\s\sif\s{"%S"\seq\s{A}}\s{\r\n\s\s\s\s\s\s\s\s\s\s\s\sset\sen_text\s%P\r\n\s\s\s\s\s\s\s\s\s\s\s\s.e\sconfigure\s-validate\skey\r\n\s\s\s\s\s\s\s\s}\r\n\s\s\s\s\s\s\s\sreturn\s1\r\n\s\s\s\s}\r\n]\r\n</pre>\r\n\r\nPressing\s'A'\scauses\sthe\sdouble\sfree\sin\sthis\sexample.\sWhen\sthe\skey\sis\spressed,\s<code>InsertChars()</code>\sstores\sthe\sexisting\s<code>entryPtr-&gt;string</code>\sin\sthe\svariable\s<code>string</code>.\sIt\sthen\sdoes\sthe\s<code>EntryValidate()</code>\s&rarr;\s<code>EntryValidateChange()</code>\sto\sevaluate\sthe\svalidatecommand\sscript.\sWhen\sthe\stextvariable\sis\sset\sin\sthe\sscript,\sthis\sinvokes\s<code>EntryTextVarProc()</code>\s&rarr;\s<code>EntrySetValue()</code>\swhich\sfrees\sthe\sexisting\s<code>entryPtr-&gt;string</code>.\sAfter\svalidation\sfinishes,\s<code>EntrySet()</code>\sthen\stries\sto\sfree\sthe\salready-freed\saddress\sin\s<code>string</code>.\r\n\r\nIt's\snot\sobvious\sto\sme\swhat\sshould\sbe\sdone\sabout\sthis\sissue.\sShould\sthis\sat\sleast\snot\slead\sto\sa\scrash/corruption,\sor\sis\sit\sbelieved\sthat\sthe\sdocumentation\salready\sfirmly\swarned\sagainst\smixing\s<code>-textvariable</code>\sand\s<code>-validatecommand</code>\ssuch\sthat\sthis\sissue\sis\sexpected\sbehavior?\sAt\sa\sminimum,\sit\spreferably\scrashes\srather\sthan\ssilently\scorrupts—i.e.\spanic\sif\s<code>string\s!=\sentryPtr-&gt;string</code>\sjust\sbefore\s<code>ckfree((char\s*)string)</code>.\r\n\r\nI\sam\snot\saware\sof\sthis\sissue\saffecting\sTtk\sentry\swidgets.
J foundin 8.6.10
J is_private 0
J login chrstphrchvz
J priority 5\sMedium
J resolution None
J severity Important
J status Open
J submitter chrstphrchvz
J subsystem 07.\s[entry]
J title Entry:\sdouble\sfree\swhen\stextvariable\sset\sin\svalidatecommand\sscript
J type Bug
K 40e4bf61988580b8ffaecd1d57a7087ba76b54d4
U chrstphrchvz
Z 5d0851794d81d9d3be5bfa4abf8e56dc