[Bug-XBoard] xboard crashes when pressing 'Pause' under Solaris 10

[Oleksandr Karpenko]

Hello,

Write to unallocated memory at line 3694 in file "backend.c":
 3693       if (currentMove == cmailOldMove + 1) {
 3694         cmailMoveType[lastLoadGameNumber - 1] = CMAIL_MOVE;
3695       }

When lastLoadGameNumber = 0, cmailOldMove = -1, currentMove = 0,
cmailOldMove = -1, line 3694 of backend.c will execute code
cmailMoveType[-1] = 0;

On my Ultra-60, cmailMoveType[-1] points exactly to buttonBarWidget,
therefore when I press 'Pause' and buttonBarWidget == 0 (overwritten
with the code above), xboard crashes:

kar60:~/chess/xboard-4.2.7 $ pstack core
core 'core' of 1994:    ./xboard -debug
 ff27a6f8 NameListToWidget (0, ffbfecc8, ffbfecc0, 0, ffbfecd8, ffbfecdc) + 44
 ff27a680 XtNameToWidget (0, 77554, 0, 0, ff25d794, 1) + 15c
 0003c0c8 ModeHighlight (18, 78f0c, 0, 50210, ff3c3f98, 18) + 178
 0005c1a0 PauseEvent (ff26d714, 821, ff270894, ff3ee0f8, ff3f06d0, 0) + 2a8
 0003ceb4 PauseProc (0, 0, 0, 0, ff2a68d0, ff2a68cc) + 14
00033e64 ???????? (38a240, 3cea0, 0, 387c78, 368d8, ff356854)
 ff270894 HandleActions (3, ffbff210, 37cdf0, 38a240, 36aaec, 36e868) + f4
 ff26f814 HandleSimpleState (10000, ff2a4000, ffbff044, 0, 36e868,
37ce30) + 39c
ff26f264 _XtTranslateEvent (38a240, 37ce30, 0, 34e0c, ff2a68f8, ff2a4000) + 80
 ff26f020 XtDispatchEventToWidget (38a240, ffbff210, 0, 1, 37ce30,
ff2a4000) + 438
ff26e6f4 _XtDefaultDispatcher (ffbff210, 1, 0, 0, 8, 0) + 1d8
 ff26e3f4 XtDispatchEvent (ffbff210, 130, 0, 36e8e0, ff2a4000, 1) + 148
 ff26bc14 XtAppMainLoop (36e8e0, 0, ffbff210, 369e0, 1, f) + 38
00031354 main     (2, ffbff4b4, ffbff4c0, 8a400, ff3a0100, ff3a0140) + 33cc
00028a68 _start   (0, 0, 0, 0, 0, 0) + 108

in xboard.c at line 5413:
 5413              XtGetValues(XtNameToWidget(buttonBarWidget, PAUSE_BUTTON),
 5414                          args, 2);
 5415              XtSetArg(args[0], XtNbackground, oldfg);
 5416              XtSetArg(args[1], XtNforeground, oldbg);

kar60:~/chess/xboard-4.2.7 $ uname -a
SunOS kar60 5.10 Generic_118822-25 sun4u sparc SUNW,Ultra-60

....
(dbx) stop access rwb &buttonBarWidget
(4) stop access rwb &buttonBarWidget, 4
(dbx) display buttonBarWidget
buttonBarWidget = 0x58ec50
(dbx) cont
watchpoint wb &buttonBarWidget (0x369eb4[4]) at line 3694 in file "backend.c"
 3694         cmailMoveType[lastLoadGameNumber - 1] = CMAIL_MOVE;
buttonBarWidget = 0x58ec50
Current function is FinishMove
 3689       SendMoveToProgram(forwardMostMove-1, &first);
(dbx) next
stopped in FinishMove at line 3698 in file "backend.c"
 3698     ShowMove(fromX, fromY, toX, toY); /*updates currentMove*/
buttonBarWidget = (nil)
(dbx) list -
3688       }
 3689       SendMoveToProgram(forwardMostMove-1, &first);
 3690       if (gameMode != EditGame && gameMode != PlayFromGameFile) {
 3691         first.maybeThinking = TRUE;
3692       }
3693       if (currentMove == cmailOldMove + 1) {
3694         cmailMoveType[lastLoadGameNumber - 1] = CMAIL_MOVE;
3695       }
3696     }
3697
(dbx) print lastLoadGameNumber
lastLoadGameNumber = 0
(dbx) print cmailOldMove
cmailOldMove = -1
(dbx) print currentMove
currentMove = 0
(dbx) print cmailOldMove
cmailOldMove = -1


It works again after my fast and dirty hack:
kar60:~/chess/xboard-4.2.7 $ diff ../xboard-4.2.7.orig/backend.c backend.c
3448c3448
< int lastLoadGameNumber = 0, lastLoadPositionNumber = 0;
---
> int lastLoadGameNumber = 1, lastLoadPositionNumber = 1;
But I am pretty sure this is not the best solution.

Good luck to provide correct solution for this problem.

--
Mit Freundlichen Grüßen,
Oleksandr Karpenko