DO NOT REPLY TO THIS MESSAGE.  INSTEAD, POST ANY RESPONSES TO THE LINK BELOW.

[STR New]

Link: http://www.fltk.org/str.php?L2836
Version: 1.3-current


When calling Fl_Window::copy_label() with the *current* label
as argument e.g.

  Fl_Window win;
  win->copy_label( win->label() );

it is possible to get memory corruption due to current implementation,
that first free()'s the existing label() - which is the same adress
as the argument - then sets the label with the now possibly corrupted
argument.

(I know it is not very usefull to make such a call, but this
is only the stripped down essence of a bug I hunted down in 
a more complex app, where things are not so obvious)

On my system (Ubuntu 11.10) the corruption happens with certainty,
don't know if it would be the same on other systems.

Fix is very easy: Just make the strdup() before the free()!

The said is also true for Fl_Widget::copy_label().

Attached a fix, a test program and a screenshot of the corrupted
window title after executing the test.


Link: http://www.fltk.org/str.php?L2836
Version: 1.3-current

_______________________________________________
fltk-bugs mailing list
[email protected]
http://lists.easysw.com/mailman/listinfo/fltk-bugs

Reply via email to