Bug 81338

Summary: Use-after-free in XUnregisterIMInstantiateCallback causes wrong behavior or crash
Product: xorg Reporter: Dmitry Antipov <dmantipov>
Component: Lib/XlibAssignee: Xorg Project Team <xorg-team>
Status: RESOLVED MOVED QA Contact: Xorg Project Team <xorg-team>
Severity: normal    
Priority: medium CC: fvogelnew1
Version: 7.7 (2012.06)   
Hardware: All   
OS: Linux (All)   
Whiteboard:
i915 platform: i915 features:
Attachments:
Description Flags
proposal fix none

Description Dmitry Antipov 2014-07-14 10:38:15 UTC 
Created attachment 102761 [details]
proposal fix

I was unable to create small and isolated example, so the only way to reproduce this bug is to run GNU Emacs with multiple X servers (Xnest is OK too). So steps to reproduce are:

1. Compile Emacs with Lucid toolkit (--with-x-toolkit=lucid) and internal checking enabled (--enable-checking).
2. Run Xnest on :1
3. Run Emacs with:

emacs -Q --eval '(let ((f (selected-frame))) (make-frame-on-display ":1.0") (delete-frame f))'

4. See assertion failure at xterm.c:8006 while checking the value returned from XUnregisterIMInstantiateCallback.

Running under Valgrind (see http://debbugs.gnu.org/cgi/bugreport.cgi?bug=17975#17) shows a use-after-free error.

Proposal fix is attached.
Comment 1 Francois Vogel 2017-09-03 08:39:07 UTC 
I ran into something that looks like the same problem with another application using XUnregisterIMInstantiateCallback, see:

https://core.tcl.tk/tk/tktview/e42eef33ee88e54d48b7279d1392b7b260acf91e

The valgrind output there shows a use-after-free error, quite identical to what is shown by the author of the present ticket, that is  http://debbugs.gnu.org/cgi/bugreport.cgi?bug=17975#17

A patch is alreavailable in this ticket, is there anything preventing it from being applied?
Comment 2 Alan Coopersmith 2017-09-11 15:52:53 UTC 
Main problem is a lack of maintainers for the XIM code - I don't know if anyone
left still knows how it works.
Comment 3 GitLab Migration User 2018-08-10 20:10:47 UTC 
-- GitLab Migration Automatic Message --

This bug has been migrated to freedesktop.org's GitLab instance and has been closed from further activity.

You can subscribe and participate further through the new bug through this link to our GitLab instance: https://gitlab.freedesktop.org/xorg/lib/libx11/issues/36.

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.