Created attachment 14590 [details]
Simple Program Demonstrating the bug

I noticed this error in valgrind yesterday when testing cursor support in my library. I wrote a minimal program to confirm this bug. Here's the output
from valgrind:

==7921== Invalid read of size 8
==7921==    at 0x4015B3E: (within /lib/ld-2.6.1.so)
==7921==    by 0x400A8F7: (within /lib/ld-2.6.1.so)
==7921==    by 0x4006174: (within /lib/ld-2.6.1.so)
==7921==    by 0x40085F7: (within /lib/ld-2.6.1.so)
==7921==    by 0x4011C98: (within /lib/ld-2.6.1.so)
==7921==    by 0x400DA05: (within /lib/ld-2.6.1.so)
==7921==    by 0x401155A: (within /lib/ld-2.6.1.so)
==7921==    by 0x6B17F8A: (within /lib/libdl-2.6.1.so)
==7921==    by 0x400DA05: (within /lib/ld-2.6.1.so)
==7921==    by 0x6B184EC: (within /lib/libdl-2.6.1.so)
==7921==    by 0x6B17EF0: dlopen (in /lib/libdl-2.6.1.so)
==7921==    by 0x505FB9C: (within /usr/lib/libX11.so.6.2.0)
==7921==    by 0x50601B3: XCreateGlyphCursor (in /usr/lib/libX11.so.6.2.0)
==7921==    by 0x50605F0: XCreateFontCursor (in /usr/lib/libX11.so.6.2.0)
==7921==    by 0x400A53: main (main.cpp:15)
==7921==  Address 0x7162b68 is 24 bytes inside a block of size 25 alloc'd
==7921==    at 0x4C21FAB: malloc (vg_replace_malloc.c:207)
==7921==    by 0x4008AF5: (within /lib/ld-2.6.1.so)
==7921==    by 0x4011C98: (within /lib/ld-2.6.1.so)
==7921==    by 0x400DA05: (within /lib/ld-2.6.1.so)
==7921==    by 0x401155A: (within /lib/ld-2.6.1.so)
==7921==    by 0x6B17F8A: (within /lib/libdl-2.6.1.so)
==7921==    by 0x400DA05: (within /lib/ld-2.6.1.so)
==7921==    by 0x6B184EC: (within /lib/libdl-2.6.1.so)
==7921==    by 0x6B17EF0: dlopen (in /lib/libdl-2.6.1.so)
==7921==    by 0x505FB9C: (within /usr/lib/libX11.so.6.2.0)
==7921==    by 0x50601B3: XCreateGlyphCursor (in /usr/lib/libX11.so.6.2.0)
==7921==    by 0x50605F0: XCreateFontCursor (in /usr/lib/libX11.so.6.2.0)
==7921==    by 0x400A53: main (main.cpp:15)
==7921== 
==7921== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 7 from 1)
==7921== malloc/free: in use at exit: 27,232 bytes in 285 blocks.
==7921== malloc/free: 1,020 allocs, 735 frees, 112,877 bytes allocated.
==7921== For counts of detected errors, rerun with: -v
==7921== searching for pointers to 285 not-freed blocks.
==7921== checked 350,488 bytes.
==7921== 
==7921== 
==7921== 192 (16 direct, 176 indirect) bytes in 1 blocks are definitely lost in loss record 10 of 22
==7921==    at 0x4C22082: realloc (vg_replace_malloc.c:429)
==7921==    by 0x50984F9: (within /usr/lib/libX11.so.6.2.0)
==7921==    by 0x5098D2F: (within /usr/lib/libX11.so.6.2.0)
==7921==    by 0x509A675: _XlcCreateLC (in /usr/lib/libX11.so.6.2.0)
==7921==    by 0x50B629F: _XlcDefaultLoader (in /usr/lib/libX11.so.6.2.0)
==7921==    by 0x50A0B43: _XOpenLC (in /usr/lib/libX11.so.6.2.0)
==7921==    by 0x50A0C0A: _XrmInitParseInfo (in /usr/lib/libX11.so.6.2.0)
==7921==    by 0x50886CF: (within /usr/lib/libX11.so.6.2.0)
==7921==    by 0x5089E6D: XrmGetStringDatabase (in /usr/lib/libX11.so.6.2.0)
==7921==    by 0x506668F: XGetDefault (in /usr/lib/libX11.so.6.2.0)
==7921==    by 0x755DD43: _XcursorGetDisplayInfo (in /usr/lib/libXcursor.so.1.0.2)
==7921==    by 0x755DF08: XcursorSupportsARGB (in /usr/lib/libXcursor.so.1.0.2)
==7921==    by 0x7560759: XcursorTryShapeCursor (in /usr/lib/libXcursor.so.1.0.2)
==7921==    by 0x5060093: XCreateGlyphCursor (in /usr/lib/libX11.so.6.2.0)
==7921==    by 0x50605F0: XCreateFontCursor (in /usr/lib/libX11.so.6.2.0)
==7921==    by 0x400A53: main (main.cpp:15)
==7921== 
==7921== LEAK SUMMARY:
==7921==    definitely lost: 16 bytes in 1 blocks.
==7921==    indirectly lost: 176 bytes in 4 blocks.
==7921==      possibly lost: 0 bytes in 0 blocks.
==7921==    still reachable: 27,040 bytes in 280 blocks.
==7921==         suppressed: 0 bytes in 0 blocks.

The leak may deserve some attention too but oddly it doesn't appear in my library where this invalid read does.

X -version returns:
X Window System Version 1.3.0
Release Date: 19 April 2007
X Protocol Version 11, Revision 0, Release 1.3
Build Operating System: Linux Ubuntu (xorg-server 2:1.3.0.0.dfsg-12ubuntu8.3)
Current Operating System: Linux localhost 2.6.22-14-generic #1 SMP Tue Feb 12 02:46:46 UTC 2008 x86_64
Build Date: 18 January 2008

Sorry if this isn't the latest version but I'm testing on Ubuntu whose packages don't remotely keep up with latest versions.
The version of valgrind I'm using is 3.3.0.