Re: Bug#8482: Uninitialized memory read in gio.

[Benjamin Kahn <xkahn cybersites com>]

On 7 Apr 2000, Owen Taylor wrote:

> I have two theories.
> 
>  1) The app is threaded, and a source is being added during 
>     to the poll. (I think to handle this properly we 
>     need another source flag like G_SOURCE_PREPARED, since 
>     there is is supposed to be an invariant that 
>     a source will be prepared before any call to ->check().
> 
>  2) Someone is callign g_io_unix_add_watch() with 
>     condition == NULL. This will produce the problem, since
>     in g_main_poll() we have:
> 
>       if (pollrec->fd->events)
> 	{
> 	  pollrec->fd->revents = fd_array[i].revents;
> 	  i++;
> 	}
> 
>     This probably should be:
> 
>       if (pollrec->fd->events)
> 	{
> 	  pollrec->fd->revents = fd_array[i].revents;
> 	  i++;
> 	}
>       else
>         pollrec->fd->revents = 0;
> 
> 
>   Benjamin - assuming that your app isn't threaded, could you 
>   temporarily insert a g_return_val_if_fail (condition != 0, 0);
>   in g_io_add_watch_full() to see if I've diagnosed this
>   correctly?

	I can add that check, but the app in question *IS* threaded.  Let
me see which threads can alter the GIOChannels. ...

	Okay.  Any thread can add or delete GIOChannels...  But they all
set a mutex to keep the others from adding at the same time.  

						-Ben

------------------------------------ |\      _,,,--,,_  ,) ----------
Benjamin Kahn                        /,`.-'`'   -,  ;-;;'
(212) 924 - 2220 ext 201            |,4-  ) )-,_ ) /\
ben@cybersites.com --------------- '---''(_/--' (_/-' ---------------
	Q: Why does it crash?
	A: Woah! You should have seen it last week! 
	    -- Linux NETFILTER-HOWTO