Immediate-Mode-UI / Immediate-Mode-UI/Nuklear
x11_rawfb demo attempts two double-frees if XShm is not available
- Dominant language
- C
- Stars
- 11.4k
- Forks
- 686
- Avg merge
- 4d 1h
- Merged PRs (30d)
- 3
Description
In `demo/x11_rawfb/nuklear_xlib.h`, if `XShmQueryExtension` fails and sets `xlib.fallback` to true, then `nk_xlib_shutdown` will end up being called twice from `nk_handle_event` which will try to double free two different things (found using AddressSanitizer):
```c
if (xlib.fallback) {
free(xlib.ximg->data);
XDestroyImage(xlib.ximg);
```
I'm not sure why the nk_handle_event (and nk_xlib_shutdown function) are called twice, but a quick fix would be to set these two variables to NULL after freeing them, and then check for null before calling the free in the first place.
Contributor guide
Research direction
Start in demo/x11_rawfb/nuklear_xlib.h by tracing nk_handle_event and nk_xlib_shutdown when XShmQueryExtension fails and xlib.fallback is true. Reproduce the path with AddressSanitizer and verify that repeated shutdown does not double-free xlib.ximg->data or xlib.ximg.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- desktop
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100