GNU logs - #77478, boring messages

Message sent to bug-gnu-emacs@HIDDEN:

Subject: bug#77478: Fixes a crash in the Haiku font driver for daemon mode
Resent-From: Kyle Ambroff-Kao <kyle@HIDDEN>
Original-Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
Resent-CC: bug-gnu-emacs@HIDDEN
Resent-Date: Thu, 03 Apr 2025 06:56:01 +0000
Resent-Message-ID: <handler.77478.B.174366335220164 <at> debbugs.gnu.org>
Resent-Sender: help-debbugs@HIDDEN
To: 77478 <at> debbugs.gnu.org
Cc: Kyle Ambroff-Kao <kyle@HIDDEN>
Feedback-ID: id7114994:Fastmail
From: Kyle Ambroff-Kao <kyle@HIDDEN>
Date: Wed, 02 Apr 2025 23:33:54 -0700
Message-ID: <86cydtg3e5.fsf@HIDDEN>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="=-=-="
Received-SPF: pass client-ip=103.168.172.145; envelope-from=kyle@HIDDEN;
 helo=fout-a2-smtp.messagingengine.com
X-Spam_score_int: -27
X-Spam_score: -2.8
X-Spam_bar: --
X-Spam_report: (-2.8 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1,
 DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1,
 RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001,
 RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_PASS=-0.001,
 SPF_PASS=-0.001 autolearn=ham autolearn_force=no
X-Spam_action: no action
X-Spam-Score: 0.7 (/)
X-Mailman-Approved-At: Thu, 03 Apr 2025 02:55:50 -0400
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -0.3 (/)

--=-=-=
Content-Type: text/plain

Tags: patch

Fix use-after-free bug in the Haiku font driver

* src/haikufont.c: Set objects freed with haikufont_close to NULL so
  they will not be reused, which seems to happen in daemon mode when all
  frames have been closed and fonts are garbage collected.

In GNU Emacs 30.1 (build 2, amd64-portbld-freebsd15.0, GTK+ Version
3.24.48, cairo version 1.18.2)
System Description: 15.0-CURRENT

Configured using:
 'configure --disable-build-details --localstatedir=/var --without-gconf
 --without-libsystemd --without-selinux --with-x --enable-acl
 --with-cairo --with-dbus --with-gif --with-gnutls --with-gsettings
 --with-x-toolkit=gtk3 --with-harfbuzz --with-jpeg
 --with-file-notification=kqueue --with-lcms2 --without-m17n-flt
 --without-imagemagick --with-mailutils --with-modules
 --with-native-compilation=aot --with-sound=oss --without-libotf
 --without-pgtk --with-png --with-toolkit-scroll-bars --with-sqlite3
 --with-rsvg --with-threads --with-tiff --with-tree-sitter --with-webp
 --without-xft --with-xim --with-xml2 --with-xpm --without-xwidgets
 --x-libraries=/usr/local/lib --x-includes=/usr/local/include
 --prefix=/usr/local --mandir=/usr/local/share/man
 --disable-silent-rules --infodir=/usr/local/share/emacs/info/
 --build=amd64-portbld-freebsd15.0 'CFLAGS=-O2 -pipe
 -fstack-protector-strong -Wl,-rpath=/usr/local/lib/gcc13 -isystem
 /usr/local/include -fno-strict-aliasing ' 'CPPFLAGS=-isystem
 /usr/local/include' 'LDFLAGS= -fstack-protector-strong
 -Wl,-rpath=/usr/local/lib/gcc13 -L/usr/local/lib/gcc13 -L/usr/local/lib
 ''


--=-=-=
Content-Type: text/patch
Content-Disposition: attachment; filename=haiku-font-double-free.diff

commit 05846e17841fce3dbbb8e15fe11d38fe44b3e5e5
Author: Kyle Ambroff-Kao <kyle@HIDDEN>
Date:   Wed Apr 2 22:34:26 2025 -0700

    Fix use-after-free bug in the Haiku font driver
    
    This fixes a bug in Emacs daemon mode on Haiku. To reproduce:
    
    1. Start emacs with "emacs --daemon"
    2. Create a new frame with "emacsclient -c" and then close it.
    3. Create a new frame with "emacsclient -c"
    
    Step 3 will cause the Emacs daemon to crash.
    
      KERN: debug_server: Thread 3616 entered the debugger: Debugger call:
      `tried to free 0xb960bc9fd0 which points at page 232 which is not an
      allocation first page'
    
    The backtrace from Emacs:
       heap_free(void*) + 0x35
       BFont_close + 0x4d
       haikufont_close(font*) + 0x29 (/Code/emacs/src/haikufont.c:893)
       sweep_vectors(void) + 0x1af (/Code/emacs/src/alloc.c:3242)
       garbage_collect(void) + 0x7b3 (/Code/emacs/src/alloc.c:7247)
       Ffuncall(ptrdiff_t, Lisp_Object*) + 0x194 (/Code/emacs/src/eval.c:3084)
       internal_condition_case_n(*, ptrdiff_t, Lisp_Object*, Lisp_Object, *)
       + 0x6c (/Code/emacs/src/eval.c:1699)
       safe_funcall(ptrdiff_t, Lisp_Object*) + 0x50 (/Code/emacs/src/eval.c:3114)
       map_keymap_canonical(Lisp_Object,map_keymap_function_t,Lisp_Object,void*)
       + 0x2b (/Code/emacs/src/keymap.c:608)
       ...
    
    It appears that the BFont has already been closed. I think that the
    driver is holding on to the pointer to the freed BFont
    (into->be_font). This patch addresses this by setting be_font to NULL so
    that this pointer will not be freed again.
    
    The same thing applies to info->metrics and info->glyphs, since just
    making this change to be_font wasn't enough to avoid crashes.
    
    With this patch I can open and close as many frames as I want without
    crashing.
    
    I don't totally understand the interactions here, and I see there are
    similar bugs in other font drivers with different workarounds. For
    example, in https://debbugs.gnu.org/cgi/bugreport.cgi?bug=16069 which I
    found from xfont.c:xfont_close, it seems like there is an attempt to
    just not free the fonts when GC is invoked.
    
    I think the solution in this patch seems a little simpler, but possibly
    means that the fonts are initialized every time the frame count goes
    from 0 to 1 or more instead of just once for the life of the daemon.

diff --git a/src/haikufont.c b/src/haikufont.c
index 7522b92207fa..72dfcc4aa3bf 100644
--- a/src/haikufont.c
+++ b/src/haikufont.c
@@ -890,25 +890,45 @@ haikufont_close (struct font *font)
     return;
 
   block_input ();
-  if (info && info->be_font)
-    BFont_close (info->be_font);
 
-  for (i = 0; i < info->metrics_nrows; i++)
+  if (info)
     {
-      if (info->metrics[i])
-	xfree (info->metrics[i]);
+      if (info->be_font)
+        {
+          BFont_close (info->be_font);
+          info->be_font = NULL;
+        }
+
+      if (info->metrics)
+        {
+          for (i = 0; i < info->metrics_nrows; i++)
+            {
+              if (info->metrics[i])
+                {
+                  xfree (info->metrics[i]);
+                  info->metrics[i] = NULL;
+                }
+            }
+
+          xfree (info->metrics);
+          info->metrics = NULL;
+        }
+
+      if (info->glyphs)
+        {
+          for (i = 0; i < 0x100; ++i)
+            {
+              if (info->glyphs[i])
+                {
+                  xfree (info->glyphs[i]);
+                }
+            }
+
+          xfree (info->glyphs);
+          info->glyphs = NULL;
+        }
     }
 
-  if (info->metrics)
-    xfree (info->metrics);
-
-  for (i = 0; i < 0x100; ++i)
-    {
-      if (info->glyphs[i])
-	xfree (info->glyphs[i]);
-    }
-
-  xfree (info->glyphs);
   unblock_input ();
 }
 

--=-=-=--

Message sent:

Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-Mailer: MIME-tools 5.505 (Entity 5.505)
Content-Type: text/plain; charset=utf-8
X-Loop: help-debbugs@HIDDEN
From: help-debbugs@HIDDEN (GNU bug Tracking System)
To: Kyle Ambroff-Kao <kyle@HIDDEN>
Subject: bug#77478: Acknowledgement (Fixes a crash in the Haiku font
 driver for daemon mode)
Message-ID: <handler.77478.B.174366335220164.ack <at> debbugs.gnu.org>
References: <86cydtg3e5.fsf@HIDDEN>
X-Gnu-PR-Message: ack 77478
X-Gnu-PR-Package: emacs
X-Gnu-PR-Keywords: patch
Reply-To: 77478 <at> debbugs.gnu.org
Date: Thu, 03 Apr 2025 06:56:02 +0000

Thank you for filing a new bug report with debbugs.gnu.org.

This is an automatically generated reply to let you know your message
has been received.

Your message is being forwarded to the package maintainers and other
interested parties for their attention; they will reply in due course.

Your message has been sent to the package maintainer(s):
 bug-gnu-emacs@HIDDEN

If you wish to submit further information on this problem, please
send it to 77478 <at> debbugs.gnu.org.

Please do not send mail to help-debbugs@HIDDEN unless you wish
to report a problem with the Bug-tracking system.

--=20
77478: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=3D77478
GNU Bug Tracking System
Contact help-debbugs@HIDDEN with problems

Message received at control <at> debbugs.gnu.org:

Received: (at control) by debbugs.gnu.org; 3 Apr 2025 08:03:25 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Thu Apr 03 04:03:25 2025
Received: from localhost ([127.0.0.1]:60858 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1u0FXo-0002tp-RU
	for submit <at> debbugs.gnu.org; Thu, 03 Apr 2025 04:03:25 -0400
Received: from mout.gmx.net ([212.227.17.22]:50609)
 by debbugs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)
 (Exim 4.84_2) (envelope-from <michael.albinus@HIDDEN>)
 id 1u0FXl-0002tP-Q6
 for control <at> debbugs.gnu.org; Thu, 03 Apr 2025 04:03:22 -0400
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmx.de;
 s=s31663417; t=1743667395; x=1744272195; i=michael.albinus@HIDDEN;
 bh=ZaIz0LkljadE1ltGhJKWlBUPr5wSHpaNMP1xY0AbUMo=;
 h=X-UI-Sender-Class:Date:Message-Id:To:From:Subject:cc:
 content-transfer-encoding:content-type:date:from:message-id:
 mime-version:reply-to:subject:to;
 b=RkpAuA2PufX+Bfy0C3HlF62VDaI/g32d4yzI3yJ68bHKWCFxeFVj8U3e0BlzN+Fq
 QBZl1iHU7Lsll731eXOm0zR9JeWHMXa7VUSk6KOq0T15tJyzIshsXu2Ax/uzwk2m+
 yTlQ8iOPf98MEVH1SDGF0pQxA7S5DzrWRksbbfRpzvXVCEYf45BhaY8dN/xQ8Y0Ar
 k+lFgmg3tFcN6igYO3xgmxdayJnQclzcswbgCI4gpRbriGblHLSLFVPedNESA/sBw
 XcQkYtbkxQXF6mlnuHL3QVIbq8m3Fr6pQIf4RsmyaC2CaFUeXo95U25+icC/lwhFV
 kSEYyW1elMmXeLPR/g==
X-UI-Sender-Class: 724b4f7f-cbec-4199-ad4e-598c01a50d3a
Received: from gandalf.gmx.de ([185.89.37.59]) by mail.gmx.net (mrgmx105
 [212.227.17.168]) with ESMTPSA (Nemesis) id 1N17YY-1sy17I3yry-010MM8 for
 <control <at> debbugs.gnu.org>; Thu, 03 Apr 2025 10:03:15 +0200
Date: Thu, 03 Apr 2025 10:03:14 +0200
Message-Id: <87bjtd7jul.fsf@HIDDEN>
To: control <at> debbugs.gnu.org
From: Michael Albinus <michael.albinus@HIDDEN>
Subject: control message for bug #77478
X-Provags-ID: V03:K1:qXf+URE5KNAXziDhc99lhNwJP8bkLztie/8djX6DeTfLntRcCSn
 Npw7qIbZhk0AcQl3skp0c+9jEHpQ/1TG0USRC7XN3gAMhlk4fLYtXI4mRr/ZH4ZO2F2elWC
 QYW/V2bGSTJZ/zZfoB/Aj67pMLhBW+U0Jb3fFABePJFWpeB8psu2QLHqXx0Z8UlpN5XoQc6
 SEuDZ1r4bqpqsdZlae3zQ==
X-Spam-Flag: NO
UI-OutboundReport: notjunk:1;M01:P0:KzJFP0VACWQ=;ZBuW3jm6a/hDbfrb0IGJF2RQfIR
 ew3XfqOOQxLpzM607BXxSDuowrTJL0aGTIPXsXheoO4i4wriOktZhTdIwphrl/XGm+OfSNddq
 1b7JJVakxYR3ONwBs8t/y7BZlhkuvpPh0EXIO5HWhL4iC9frE2S42bptv17yMJ4gOHJnBSKMB
 VKKe+AgU/RXffQsufFM/B/lkDrlfMsCFsmBN4pRQDEGGlcvYSEAvL9tAj5gX2ADAjhSVgMJuL
 byWDb6tEGFcR/MtUmpSMmsWpjk3JH9/xhw7fddim+InYk0Mk5LAmdD/7acmm5+TwPbiI5kyqg
 ftLNDC/B+/O7A9fervLfWf4OzAWAnEGZQikRGj+pCJM3ZUomBWGcZW4xInstg9efswqWUZCbY
 YiYjrCzGCufjMcRxbgVU6DtXokx5ISB/vZ5Y5NteAogzFy+Gr3yprmqEeTAPjyCNFhCJWLZO+
 H48As32A8SBajs7jYXU0vx0ZpRBve1T8DCb1AZN28HZ7f1Lvrpo6dSzIjGBrmE/t0wrz8FBTe
 84s28TNW6y0iN/OAs5thkjuzcJ0bp1Km1YnUOtbNy1YiuP3jIwFH7vd7dxYM/mQZan+oaGRJp
 t7nnwKM3aXftg88n2/xUOu4NVr+2B8uUMAgDrs+YzYp0QacpnAWA9p5nna+wkv/LJEH4O1WMa
 H9XLq1tZ2qiWrlt0+ayFwSpJcI9ySwOV06Sc6/OdwBU78ALgpsoYWVr8y4KxtTVXRzI1n76if
 5l3FZiJHUeZCG2bERI3+G9RwNb24+h2rkV/hkTRg0Xv7S4R8qxZHRkRgS4+fmANz+HI6264Eo
 VdN8J6dtA5diWV1armhI4mYD6dmITDVkgzdl1cF/ov/kRiAdIoJ6reI8kch/Cc2DHPNpFXJsn
 3OR1HlpcxyiYa1wfgVm/AxuN68ofeQWP8C4lkYxqxwjjkUKRWNgmfC3pBwcCBFnQ301244MWW
 qlIvH0Duc6RCFNPyuu/oq2hdm9tfTqD+6zdzTY0jLIzxQPT4eEc4UAKV+exV1keYEz58zcIwK
 ea4hoZLs76ptd03BYUrPxJdDwmeMpj/VtEZTDRGZjDH5jU13lHF2zPE+8NPSyczAxGz42Bj7D
 uBQmw9Zsm7LzQpieHCSOPXeexk1JnRASNKstD/RdAiCfD3YoIt0sMNNrX9smlEb0Vj7tuqxz5
 gYBbVB9MQm/9UT+IaXdF30mE8vwXPc4GoaWU/ieUziTKAunCVOE2dPnXbVA+LmGWx6cX3nrNO
 13zZyyGcx/G7/beMoSui02g7f55Z1z7MR4OAvufolxbPt7gtJJJWhg7S+2+Abf3QpcjeN79TB
 9ENHuv3Q3AqMuxlp/CbijOujztkkrp1psUfTHxoxBZHha8V3BSt3l57Xk9QnbMAI79vUkW6oj
 5epCY0hfd9n8ssIM6OdG+C/kg2ARCRN+X25n+jJ3lDHR+5ZRiLp3IEMCAiz4WOuwEfDo2fm6Y
 8/rRdc2AKpZkTgIRplx5qjItlLzK3MOyNEsWdc3MmqkbqfCOO
X-Spam-Score: -0.7 (/)
X-Debbugs-Envelope-To: control
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -1.7 (-)

merge 77478 77479
quit

Last modified: Thu, 3 Apr 2025 08:15:01 UTC

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997 nCipher Corporation Ltd, 1994-97 Ian Jackson.