twm can segfault when it cannot collect attribute information on a window that has been destroyed before it got a chance to collect it's attributes. twm seems to assume that it is always able to collect this information and disregards the error if the function that attempts to collect it fails and CreateColormapWindow() returns NULL. If this happens correct number_cmap_windows to prevent a SEGV later on due to an incorrect setting.
Signed-off-by: Egbert Eich <[email protected]> --- src/add_window.c | 6 ++++-- 1 files changed, 4 insertions(+), 2 deletions(-) diff --git a/src/add_window.c b/src/add_window.c index 8cf23c5..72aa0aa 100644 --- a/src/add_window.c +++ b/src/add_window.c @@ -1535,10 +1535,12 @@ FetchWmColormapWindows (TwmWindow *tmp) cwins = (ColormapWindow **) malloc(sizeof(ColormapWindow *)); if (XFindContext(dpy, tmp->w, ColormapContext, (caddr_t *)&cwins[0]) == - XCNOENT) + XCNOENT) { cwins[0] = CreateColormapWindow(tmp->w, (Bool) tmp->cmaps.number_cwins == 0, False); - else + if (cwins[0] == NULL) + number_cmap_windows = 0; + } else cwins[0]->refcnt++; } -- 1.7.7 _______________________________________________ [email protected]: X.Org development Archives: http://lists.x.org/archives/xorg-devel Info: http://lists.x.org/mailman/listinfo/xorg-devel
