[comp.windows.x] Null pointer X Toolkit bug

dayoung%hplday@HPLABS.HP.COM (Doug Young) (05/14/88)

This may already be a known bug, but there appears to be a Null
pointer bug in the timeout handling of the X Toolkit which causes a
core dump when setting a single timeout which doesn't add itself back.
The section of code that calls the timeout handlers, in NextEvent.c,
is:

if (TimerQueue!= NULL) {	/* check timeout queue */
	while(IS_AFTER (TimerQueue->te_timer_value, cur_time)) {  
		te_ptr = TimerQueue;
		TimerQueue = TimerQueue->te_next;   
		te_ptr->te_next = NULL;
		TeCallProc(te_ptr);
		XtFree((char*)te_ptr);
	}
}

If there is only a single function in the timer queue, TimerQueue will
be set to NULL the first time through the body of the loop and then,
the second time through the while, the test will attempt to
dereference the NULL pointer.

Changing this (in the three places this code occurs) to:

while(TimerQueue != NULL && 
        IS_AFTER (TimerQueue->te_timer_value, cur_time)) {
    te_ptr = TimerQueue;
    TimerQueue = TimerQueue->te_next;
    te_ptr->te_next = NULL;
    TeCallProc(te_ptr);
    XtFree((char*)te_ptr);
}

Seems to do the trick on my HP machine.  If there is a better place to
report such things, please let me know.

Doug Young (dayoung@hplabs.hp.com)

RWS@ZERMATT.LCS.MIT.EDU (Robert Scheifler) (05/14/88)

    Date: Fri, 13 May 88 15:34:50 PDT
    From: Doug Young <dayoung%hplday@hplabs.hp.com>

    If there is a better place to
    report such things, please let me know.

If you read the release notes, it says to send bug
reports (using the form in doc/bugs/bug-report) to
xbugs@expo.lcs.mit.edu.