Immediate-Mode-UI / Immediate-Mode-UI/Nuklear

x11_rawfb demo attempts two double-frees if XShm is not available

Open
#340 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
11.4k
Forks
686
Avg merge
4d 1h
Merged PRs (30d)
3

Description

In `demo/x11_rawfb/nuklear_xlib.h`, if `XShmQueryExtension` fails and sets `xlib.fallback` to true, then `nk_xlib_shutdown` will end up being called twice from `nk_handle_event` which will try to double free two different things (found using AddressSanitizer):

```c
if (xlib.fallback) {
free(xlib.ximg->data);
XDestroyImage(xlib.ximg);
```

I'm not sure why the nk_handle_event (and nk_xlib_shutdown function) are called twice, but a quick fix would be to set these two variables to NULL after freeing them, and then check for null before calling the free in the first place.

Contributor guide

Open the contributing guide

Research direction

Start in demo/x11_rawfb/nuklear_xlib.h by tracing nk_handle_event and nk_xlib_shutdown when XShmQueryExtension fails and xlib.fallback is true. Reproduce the path with AddressSanitizer and verify that repeated shutdown does not double-free xlib.ximg->data or xlib.ximg.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
desktop
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.