Re: horizontal resize + wide swindow causes core dump

[Thomas Dickey]

On Mon, Oct 21, 2002 at 07:50:08PM -0400, Lucas Gonze wrote:
> 
> In the enclosed code, the one factor affecting whether there is a segfault
> is the width of a CDKSWINDOW object.  The crash itself, however, is in
> ncurses rather than cdk.

is that ncurses 5.2, or 5.3 ?
 
> Following the torture test method of grabbing the border and resizing back
> and forth 10-20 times, I noticed that the crash only happened when I
> grabbed the right border and resized horizontally.  More testing showed
> that if the width of the swindow is maxx-2, the crash happens, and if the
> width is (maxx-2)/2, the crash doesn't happen.  My guess as to the meaning
> of this is that it happens when the resize leaves the terminal width less
> than the swindow width.
> 
> The command line for the build is: 
> gcc -g -DNCURSES -I/16G/shared_software/cdk-4.9.10/

....and cdk 4.9.10, or 4.9.10-20020809 ?

(running with current code, a quick check with valgrind doesn't show
any malloc issues - though the program may die in assert_ptr()).

> -I/16G/shared_software/cdk-4.9.10//include
> -I/16G/shared_software/cdk-4.9.10//c++ Crasher.cpp -o test/crasher -I
> -L/usr/lib/ -L/16G/shared_software/cdk-4.9.10/ -lcdk -lncurses -lm
> -lstdc++
> 
> If I attach to the crashed process the stack trace is:
> (gdb) where
> #0  0x40158af0 in chunk_realloc (ar_ptr=0x4020c300, oldp=0x8074028, 
> oldsize=200, nb=344)
>     at malloc.c:3430
> #1  0x401589e2 in __libc_realloc (oldmem=0x8074030, bytes=340) at 
> malloc.c:3390
> #2  0x40057d3c in _nc_doalloc () from /usr/lib/libncurses.so.5
> #3  0x40051d8f in wresize () from /usr/lib/libncurses.so.5
> #4  0x400518ad in resizeterm () from /usr/lib/libncurses.so.5
> #5  0x40059235 in _nc_update_screensize () from /usr/lib/libncurses.so.5
> #6  0x40044057 in wgetch () from /usr/lib/libncurses.so.5
> #7  0x0806f065 in Crasher::keystroke_loop (this=0x8071a38) at 
> Crasher.cpp:92
> #8  0x08049637 in main (argc=1, argv=0xbfffe074) at Crasher.cpp:107
> 
> 
> 
> See #define DOCRASH in the following code:
> //*****************************************
> //* Crasher.h: reproduce CDK crash on resize.  build and run this
> //* code, then grab the vertical window border and resize left and right
> //* for a little while.  you'll get a segfault.  see #define DOCRASH for 
> //* the exact source of the error.
> //*
> //* Lucas Gonze <address@hidden>
> //*****************************************
> 
> #include <iostream>
> #include <fstream>
> #include <curses.h>
> #include <signal.h>
> #include <vector>
> #include <string>
> 
> extern "C"
> {
> #include <cdk.h>
> }
> 
> class Crasher {
>  protected:
>   WINDOW *cursesWin;
>   CDKSCREEN *cdkscreen;
> 
>   void assert_ptr(void *ptr){
>     if( !ptr ){
>       destroyCDKScreen (cdkscreen);
>       endCDK();
>       cerr << "Allocation failure in windowing toolkit" << endl;
>       exit(1);
>     }    
>   }
> 
>   void init_screen(){
> 
>     int maxx, maxy;
>     getmaxyx(cursesWin, maxy, maxx);
>     if( maxy < 0 || maxx < 0)
>       assert_ptr(NULL);
> 
>     assert_ptr( cdkscreen = initCDKScreen(cursesWin) );
>     initCDKColor();
> 
> #define DOCRASH 1
> #if DOCRASH
>     int swindowWidth = maxx-2;
> #else
>     int swindowWidth = (maxx-2)/2;
> #endif
>     assert_ptr( newCDKSwindow (cdkscreen, LEFT, 5, 10, swindowWidth, 
>                              (char *)"Swindow Title", 10, TRUE, FALSE) 
> );
>   }
> 
> 
>  public:
> 
>   Crasher(){
> 
>     cursesWin = initscr();
>     init_screen();
>     refreshCDKScreen (cdkscreen);
>   }
> 
>   void recalc_window(){
> 
>     if( !cdkscreen )
>       return;
> 
>     // reinitialize the screen to match new coordinates
>     destroyCDKScreen (cdkscreen);
>     endCDK();
>     init_screen();
> 
>     // redraw to pickup changes
>     refreshCDKScreen(cdkscreen);
> 
>   }
> 
>   ~Crasher(){
>     destroyCDKScreen(cdkscreen);
>     delwin (cursesWin);
>     endCDK();
>   }
> 
>   void keystroke_loop(){
> 
>     while(true){
>       switch( wgetch (cursesWin) ){
>       case KEY_RESIZE:
>       recalc_window();
>       break;
>       default:
>       ;
>       }
>     }
>   }
> 
> };
> 
> int main (int argc, char **argv){
> 
>   Crasher *victim = new Crasher();
>   victim->keystroke_loop();
>   delete victim;
> }
> 
> 
> 
> 
> 
> 
> 
> 
> _______________________________________________
> Bug-ncurses mailing list
> address@hidden
> http://mail.gnu.org/mailman/listinfo/bug-ncurses

-- 
Thomas E. Dickey <address@hidden>
http://invisible-island.net
ftp://invisible-island.net