From: raj@colsa.com (Raj Manandhar)
Message-ID: <m10SlpX-00026UC@droid.colsa.com>
Sender: raj@colsa.com (Raj Manandhar)
Date: Thu, 1 Apr 1999 12:04:39 -0600 (CST)
To: submit@bugs.debian.org
Subject: xlock core dumps at exit when I compile it


Package: xlockmore
Version 4.12-4
When I compile it from source under Debian 2.1, egcc 2.91.60, libc-2.0.7,
and run it as follows:

xlock  -nolock -mode flag -bitmap pixmaps/l-linux.xpm 

and then hit any key (to quit), it gives a seg fault.

The following patch fixes it:

cd /data/raj/xlockmore-4.12/modes/
diff -u /data/raj/xlockmore-4.12/modes/flag.c\~ /data/raj/xlockmore-4.12/modes/flag.c
--- /data/raj/xlockmore-4.12/modes/flag.c~	Mon Sep 28 10:26:11 1998
+++ /data/raj/xlockmore-4.12/modes/flag.c	Thu Apr  1 11:35:06 1999
@@ -146,7 +146,7 @@
 #define MAXINITSIZE 6
 #define MININITSIZE 2
 #define MINAMP 5
-#define MAXAMP 20
+#define MAXAMP 5
 #define MAXW(fp) (MAXSCALE * (fp)->image->width + 2 * MAXAMP + (fp)->pointsize + 2 * (fp)->sofs)
 #define MAXH(fp) (MAXSCALE * (fp)->image->height+ 2 * MAXAMP + (fp)->pointsize + 2 * (fp)->sofs)
 #define MINW(fp) (MINSCALE * (fp)->image->width + 2 * MINAMP + (fp)->pointsize)
@@ -558,8 +558,10 @@
 				if (fp->choice == IMAGE_FLAG && (fp->graphics_format == IS_XBM ||
 					  fp->graphics_format == IS_XBMDONE))
 					XFree((caddr_t) fp->image);	/* Do not destroy data */
-				else
+				else {
 					(void) XDestroyImage(fp->image);
+				}
+				fp->logo = NULL;
 			}
 			free_stuff(display, fp);
 		}

And it also reduces the flag amplitude (the original looks ugly, I think).

Both source and binary versions die with a seg fault if they are run with
a bitmap

xlock  -nolock -mode flag -bitmap bitmaps/l-linux.xbm 

(the binary version doesn't die with an xpm I presume because xpm wasn't
compiled into the binary, so it doesn't follow the same code path).

I think what is happening is the XImages with the pixmap or bitmap are 
being freed twice in flag.c: once through fp->image, once through fp->logo.
I'm no expert on this, but my read of the XDestroyImage man page says that
the image data will be freed:

The XDestroyImage function deallocates the memory associated with the XImage structure.   

The patch above doesn't fix the core dump with the bitmap because the bitmap
uses a static blogo structure in iostuff.c which I am too confused by to 
touch.

Raj  (raj@colsa.com)