Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 406487 - x11-libs/libXaw3d-1.6.1: Fix use-after-free in DestroyAllIM (was: app-text/gv-3.7.3 crashes on exit)
Summary: x11-libs/libXaw3d-1.6.1: Fix use-after-free in DestroyAllIM (was: app-text/gv...
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: AMD64 Linux
: Low minor (vote)
Assignee: Gentoo X packagers
URL: http://lists.x.org/archives/xorg-deve...
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2012-03-01 21:27 UTC by Samuli Suominen (RETIRED)
Modified: 2012-03-05 09:44 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments
backtrace (gv-3.7.3-libXawd-1.6.1-crash-on-exit.gdb.bt.txt,3.02 KB, text/plain)
2012-03-01 21:27 UTC, Samuli Suominen (RETIRED)
Details
backtrace (gdb-gv.txt,2.87 KB, text/plain)
2012-03-01 21:29 UTC, Samuli Suominen (RETIRED)
Details
patch (0001-Fix-use-after-free-in-DestroyAllIM.patch,1.15 KB, patch)
2012-03-01 21:53 UTC, Matt Turner
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Samuli Suominen (RETIRED) gentoo-dev 2012-03-01 21:27:56 UTC
Created attachment 303883 [details]
backtrace

the program works fine far as I can tell, but once you close the window and when the program is ran from terminal, you see "Segmentation fault" after some unrelated font not found messages

note: the attached backtrace is with all direct dependencies of gv, and gv itself, built with -ggdb.

Portage 2.2.0_alpha89 (default/linux/amd64/10.0/developer, gcc-4.6.2, glibc-2.14.1-r2, 3.1.4 x86_64)
=================================================================
System uname: Linux-3.1.4-x86_64-Intel-R-_Core-TM-_i5-2400_CPU_@_3.10GHz-with-gentoo-2.1
Timestamp of tree: Unknown
app-shells/bash:          4.2_p20
dev-java/java-config:     2.1.11-r3
dev-lang/python:          2.7.2-r3, 3.2.2
dev-util/cmake:           2.8.7-r3
dev-util/pkgconfig:       0.26
sys-apps/baselayout:      2.1
sys-apps/openrc:          0.9.9
sys-apps/sandbox:         2.5
sys-devel/autoconf:       2.13, 2.68
sys-devel/automake:       1.4_p6-r1, 1.9.6-r3, 1.10.3, 1.11.3
sys-devel/binutils:       2.22-r1
sys-devel/gcc:            4.6.2
sys-devel/gcc-config:     1.5-r2
sys-devel/libtool:        2.4.2
sys-devel/make:           3.82-r3
sys-kernel/linux-headers: 3.2 (virtual/os-headers)
sys-libs/glibc:           2.14.1-r2
Repositories:

Installed sets: 
ABI="amd64"
ACCEPT_KEYWORDS="amd64 ~amd64"
ACCEPT_LICENSE="*"
ACCEPT_PROPERTIES="*"
ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci"
ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug file hooks iec958 ioplug ladspa lfloat linear meter mmap_emul mulaw multi null plug rate route share shm softvol"
APACHE2_MODULES="actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias"
ARCH="amd64"
AUTOCLEAN="yes"
BC_ENV_ARGS="-l"
BOOTSTRAP_USE="cxx unicode multilib"
CALLIGRA_FEATURES="kexi words flow plan stage tables krita karbon braindump"
CAMERAS="ptp2"
CBUILD="x86_64-pc-linux-gnu"
CFLAGS="-march=native -O2 -pipe"
CFLAGS_amd64="-m64"
CFLAGS_x32="-mx32"
CFLAGS_x86="-m32"
CHOST="x86_64-pc-linux-gnu"
CHOST_amd64="x86_64-pc-linux-gnu"
CHOST_x32="x86_64-pc-linux-gnu"
CHOST_x86="i686-pc-linux-gnu"
CLEAN_DELAY="0"
COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog"
COLLISION_IGNORE="/lib/modules"
COLORTERM="Terminal"
CONFIG_PROTECT="/etc /usr/share/config /usr/share/gnupg/qualified.txt"
CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/dconf /etc/env.d /etc/env.d/java/ /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo /etc/texmf/language.dat.d /etc/texmf/language.def.d /etc/texmf/updmap.d /etc/texmf/web2c"
CVS_RSH="ssh"
CXXFLAGS="-march=native -O2 -pipe"
DBUS_SESSION_BUS_ADDRESS="unix:abstract=/tmp/dbus-czhBnGRfHO,guid=f7be500a025a474a7f1088dc000c2a3a"
DEFAULT_ABI="amd64"
DESKTOP_SESSION="xfce"
DISPLAY=":0.0"
DISTDIR="/usr/portage/distfiles"
ECHANGELOG_USER="Samuli Suominen <ssuominen@gentoo.org>"
EDITOR="/bin/nano"
ELIBC="glibc"
EMERGE_DEFAULT_OPTS="--quiet-build=n -v"
EMERGE_WARNING_DELAY="0"
EPREFIX=""
EROOT="/"
FCFLAGS=""
FEATURES="assume-digests binpkg-logs collision-protect distlocks ebuild-locks fixlafiles multilib-strict news parallel-fetch preserve-libs protect-owned sandbox sfperms sign strict unknown-features-warn unmerge-logs unmerge-orphans userfetch userpriv usersandbox"
FETCHCOMMAND="wget -t 3 -T 60 --passive-ftp -O "${DISTDIR}/${FILE}" "${URI}""
FETCHCOMMAND_RSYNC="rsync -avP "${URI}" "${DISTDIR}/${FILE}""
FETCHCOMMAND_SFTP="bash -c "x=\${2#sftp://} ; host=\${x%%/*} ; port=\${host##*:} ; host=\${host%:*} ; [[ \${host} = \${port} ]] && port=22 ; exec sftp -P \${port} \"\${host}:/\${x#*/}\" \"\$1\"" sftp "${DISTDIR}/${FILE}" "${URI}""
FETCHCOMMAND_SSH="bash -c "x=\${2#ssh://} ; host=\${x%%/*} ; port=\${host##*:} ; host=\${host%:*} ; [[ \${host} = \${port} ]] && port=22 ; exec rsync --rsh=\"ssh -p\${port}\" -avP \"\${host}:/\${x#*/}\" \"\$1\"" rsync "${DISTDIR}/${FILE}" "${URI}""
FFLAGS=""
FLTK_DOCDIR="/usr/share/doc/fltk-1.3.0-r1/html"
GCC_SPECS=""
GDK_USE_XFT="1"
GENTOO_MIRRORS="http://distfiles.gentoo.org"
GLADE_CATALOG_PATH=":"
GLADE_MODULE_PATH=":"
GLADE_PIXMAP_PATH=":"
GPG_AGENT_INFO="/tmp/gpg-NkTptH/S.gpg-agent:1835:1"
GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf superstar2 timing tsip tripmate tnt ubx"
GRUB_PLATFORMS=""
GSETTINGS_BACKEND="dconf"
GUILE_LOAD_PATH="/usr/share/guile/1.8"
HG="/usr/bin/hg"
HOME="/home/ssuominen"
HUSHLOGIN="FALSE"
INFOPATH="/usr/share/info:/usr/share/binutils-data/x86_64-pc-linux-gnu/2.22/info:/usr/share/gcc-data/x86_64-pc-linux-gnu/4.6.2/info:/usr/share/info/emacs-23"
INPUT_DEVICES="evdev"
I_KNOW_WHAT_I_AM_DOING="yes"
JAVAC="/etc/java-config-2/current-system-vm/bin/javac"
JAVA_HOME="/etc/java-config-2/current-system-vm"
JDK_HOME="/etc/java-config-2/current-system-vm"
KERNEL="linux"
LADSPA_PATH="/usr/lib64/ladspa"
LANG="en_US.UTF-8"
LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text"
LC_CTYPE="fi_FI.UTF-8"
LDFLAGS="-Wl,-O1 -Wl,--as-needed -Wl,--hash-style=gnu"
LDFLAGS_amd64="-m elf_x86_64"
LDFLAGS_x32="-m elf32_x86_64"
LDFLAGS_x86="-m elf_i386"
LESS="-R -M --shift 5"
LESSOPEN="|lesspipe %s"
LIBDIR_amd64="lib64"
LIBDIR_amd64_fbsd="lib64"
LIBDIR_n32="lib32"
LIBDIR_n64="lib64"
LIBDIR_o32="lib"
LIBDIR_ppc="lib32"
LIBDIR_ppc64="lib64"
LIBDIR_s390="lib32"
LIBDIR_s390x="lib64"
LIBDIR_sparc32="lib32"
LIBDIR_sparc64="lib64"
LIBDIR_x32="libx32"
LIBDIR_x86="lib32"
LIBDIR_x86_fbsd="lib32"
LIBGLADE_MODULE_PATH=":/usr/lib64/libglade/2.0"
LINGUAS="en"
LOGNAME="ssuominen"
LS_COLORS="rs=0:di=01;34:ln=01;36:mh=00:pi=40;33:so=01;35:do=01;35:bd=40;33;01:cd=40;33;01:or=01;05;37;41:mi=01;05;37;41:su=37;41:sg=30;43:ca=30;41:tw=30;42:ow=34;42:st=37;44:ex=01;32:*.tar=01;31:*.tgz=01;31:*.arj=01;31:*.taz=01;31:*.lzh=01;31:*.lzma=01;31:*.tlz=01;31:*.txz=01;31:*.zip=01;31:*.z=01;31:*.Z=01;31:*.dz=01;31:*.gz=01;31:*.lz=01;31:*.xz=01;31:*.bz2=01;31:*.bz=01;31:*.tbz=01;31:*.tbz2=01;31:*.tz=01;31:*.deb=01;31:*.rpm=01;31:*.jar=01;31:*.war=01;31:*.ear=01;31:*.sar=01;31:*.rar=01;31:*.ace=01;31:*.zoo=01;31:*.cpio=01;31:*.7z=01;31:*.rz=01;31:*.jpg=01;35:*.jpeg=01;35:*.gif=01;35:*.bmp=01;35:*.pbm=01;35:*.pgm=01;35:*.ppm=01;35:*.tga=01;35:*.xbm=01;35:*.xpm=01;35:*.tif=01;35:*.tiff=01;35:*.png=01;35:*.svg=01;35:*.svgz=01;35:*.mng=01;35:*.pcx=01;35:*.mov=01;35:*.mpg=01;35:*.mpeg=01;35:*.m2v=01;35:*.mkv=01;35:*.webm=01;35:*.ogm=01;35:*.mp4=01;35:*.m4v=01;35:*.mp4v=01;35:*.vob=01;35:*.qt=01;35:*.nuv=01;35:*.wmv=01;35:*.asf=01;35:*.rm=01;35:*.rmvb=01;35:*.flc=01;35:*.avi=01;35:*.fli=01;35:*.flv=01;35:*.gl=01;35:*.dl=01;35:*.xcf=01;35:*.xwd=01;35:*.yuv=01;35:*.cgm=01;35:*.emf=01;35:*.axv=01;35:*.anx=01;35:*.ogv=01;35:*.ogx=01;35:*.pdf=00;32:*.ps=00;32:*.txt=00;32:*.patch=00;32:*.diff=00;32:*.log=00;32:*.tex=00;32:*.doc=00;32:*.aac=00;36:*.au=00;36:*.flac=00;36:*.mid=00;36:*.midi=00;36:*.mka=00;36:*.mp3=00;36:*.mpc=00;36:*.ogg=00;36:*.ra=00;36:*.wav=00;36:*.axa=00;36:*.oga=00;36:*.spx=00;36:*.xspf=00;36:"
MAIL="/var/mail/ssuominen"
MAKEOPTS="-j9"
MANPATH="/etc/java-config-2/current-system-vm/man:/usr/local/share/man:/usr/share/man:/usr/share/binutils-data/x86_64-pc-linux-gnu/2.22/man:/usr/share/gcc-data/x86_64-pc-linux-gnu/4.6.2/man:/etc/java-config/system-vm/man/"
MULTILIB_ABIS="amd64 x86"
MULTILIB_STRICT_DENY="64-bit.*shared object"
MULTILIB_STRICT_DIRS="/lib32 /lib /usr/lib32 /usr/lib /usr/kde/*/lib32 /usr/kde/*/lib /usr/qt/*/lib32 /usr/qt/*/lib /usr/X11R6/lib32 /usr/X11R6/lib"
MULTILIB_STRICT_EXEMPT="(perl5|gcc|gcc-lib|binutils|eclipse-3|debug|portage|udev)"
NETBEANS="apisupport cnd groovy gsf harness ide identity j2ee java mobility nb php profiler soa visualweb webcommon websvccommon xml"
OLDPWD="/home/ssuominen"
OPENCL_PROFILE="nvidia"
OPENGL_PROFILE="nvidia"
PAGER="/usr/bin/less"
PATH="/usr/local/bin:/usr/bin:/bin:/opt/bin:/usr/x86_64-pc-linux-gnu/gcc-bin/4.6.2:/usr/games/bin"
PERL5LIB="/usr/share/pkgconfig-openbsd"
PHP_TARGETS="php5-3"
PKGDIR="/usr/portage/packages"
PORTAGE_ARCHLIST="ppc sparc64-freebsd ppc-openbsd x86-openbsd ppc64 x86-winnt x86-fbsd ppc-aix alpha arm x86-freebsd s390 amd64 arm-linux x86-macos x64-openbsd ia64-hpux hppa x86-netbsd x86-cygwin amd64-linux ia64-linux x86 sparc-solaris x64-freebsd sparc64-solaris x86-linux x64-macos sparc m68k-mint ia64 mips ppc-macos x86-interix hppa-hpux amd64-fbsd x64-solaris m68k sh x86-solaris sparc-fbsd"
PORTAGE_BINHOST_CHUNKSIZE="3000"
PORTAGE_BIN_PATH="/usr/lib64/portage/bin"
PORTAGE_COMPRESS_EXCLUDE_SUFFIXES="css gif htm[l]? jp[e]?g js pdf png"
PORTAGE_CONFIGROOT="/"
PORTAGE_DEBUG="0"
PORTAGE_DEPCACHEDIR="/var/cache/edb/dep"
PORTAGE_ELOG_CLASSES="log warn error qa"
PORTAGE_ELOG_MAILFROM="portage@localhost"
PORTAGE_ELOG_MAILSUBJECT="[portage] ebuild log for ${PACKAGE} on ${HOST}"
PORTAGE_ELOG_MAILURI="root"
PORTAGE_ELOG_SYSTEM="save_summary echo"
PORTAGE_FETCH_CHECKSUM_TRY_MIRRORS="5"
PORTAGE_FETCH_RESUME_MIN_SIZE="350K"
PORTAGE_GID="250"
PORTAGE_GPG_DIR="/home/ssuominen/.gnupg"
PORTAGE_GPG_KEY="4868F14D"
PORTAGE_GPG_SIGNING_COMMAND="gpg --sign --clearsign --yes --default-key "${PORTAGE_GPG_KEY}" --homedir "${PORTAGE_GPG_DIR}" "${FILE}""
PORTAGE_INST_GID="0"
PORTAGE_INST_UID="0"
PORTAGE_OVERRIDE_EPREFIX=""
PORTAGE_PYM_PATH="/usr/lib64/portage/pym"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --stats --human-readable --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages"
PORTAGE_RSYNC_RETRIES="-1"
PORTAGE_SYNC_STALE="30"
PORTAGE_TMPDIR="/var/tmp"
PORTAGE_VERBOSE="1"
PORTAGE_WORKDIR_MODE="0700"
PORTDIR="/home/ssuominen/gentoo-x86"
PORTDIR_OVERLAY="/usr/local/portage"
PORT_LOGDIR="/var/log/portage"
PORT_LOGDIR_CLEAN="find "${PORT_LOGDIR}" -type f ! -name "summary.log*" -mtime +7 -delete"
PRELINK_PATH_MASK="/usr/lib64/libfreebl3.so:/usr/lib64/libnssdbm3.so:/usr/lib64/libsoftokn3.so"
PROFILE_ONLY_VARIABLES="ARCH ELIBC KERNEL USERLAND"
PWD="/home/ssuominen/gentoo-x86/app-text/gv"
PYTHONDONTWRITEBYTECODE="1"
QT_GRAPHICSSYSTEM="raster"
QT_PLUGIN_PATH="/usr/lib64/kde4/plugins"
RESUMECOMMAND="wget -c -t 3 -T 60 --passive-ftp -O "${DISTDIR}/${FILE}" "${URI}""
RESUMECOMMAND_RSYNC="rsync -avP "${URI}" "${DISTDIR}/${FILE}""
RESUMECOMMAND_SSH="bash -c "x=\${2#ssh://} ; host=\${x%%/*} ; port=\${host##*:} ; host=\${host%:*} ; [[ \${host} = \${port} ]] && port=22 ; exec rsync --rsh=\"ssh -p\${port}\" -avP \"\${host}:/\${x#*/}\" \"\$1\"" rsync "${DISTDIR}/${FILE}" "${URI}""
ROOT="/"
ROOTPATH="/opt/bin:/usr/x86_64-pc-linux-gnu/gcc-bin/4.6.2"
RPMDIR="/usr/portage/rpm"
RUBY_TARGETS="ruby18"
SESSION_MANAGER="local/null:@/tmp/.ICE-unix/32634,unix/null:/tmp/.ICE-unix/32634"
SHELL="/bin/bash"
SHLVL="4"
SSH_AGENT_PID="1810"
SSH_AUTH_SOCK="/tmp/ssh-GqzcvZji1809/agent.1809"
SYMLINK_LIB="yes"
SYNC="rsync://rsync.gentoo.org/gentoo-portage"
TERM="xterm"
USE="X a52 aac acl acpi alsa amd64 archive berkdb bluetooth bluray bzip2 cairo cdda cdr cli consolekit cracklib crypt cxx dbus dri dts dvd dvdr emboss encode exif fam fat firefox flac fluidsynth fontconfig fortran g3dvl gdbm gdu gif gpm gtk gtk3 iconv ipv6 jpeg kpathsea lcms libnotify libv4l libv4l2 lzma mad mmx mng modules mp3 mp4 mpeg mudflap multilib ncurses nls nptl nptlonly ntfs ogg openal opengl openmp pam pango pcre pdf perl png policykit postproc ppds pppd python qt3support qt4 readline sdl session sndfile spell sse sse2 sse3 ssl ssse3 startup-notification svg sysfs tcpd threads tiff timidity truetype udev unicode usb v4l v4l2 vdpau vim-syntax vorbis x264 xcb xcomposite xine xml xorg xscreensaver xulrunner xv xvid zlib" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug file hooks iec958 ioplug ladspa lfloat linear meter mmap_emul mulaw multi null plug rate route share shm softvol" APACHE2_MODULES="actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" CALLIGRA_FEATURES="kexi words flow plan stage tables krita karbon braindump" CAMERAS="ptp2" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf superstar2 timing tsip tripmate tnt ubx" INPUT_DEVICES="evdev" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LINGUAS="en" PHP_TARGETS="php5-3" RUBY_TARGETS="ruby18" USERLAND="GNU" VIDEO_CARDS="nvidia" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq steal rawnat logmark ipmark dhcpmac delude chaos account"
USER="ssuominen"
USERLAND="GNU"
USE_EXPAND="ALSA_CARDS ALSA_PCM_PLUGINS APACHE2_MODULES APACHE2_MPMS CALLIGRA_FEATURES CAMERAS COLLECTD_PLUGINS CROSSCOMPILE_OPTS DRACUT_MODULES DVB_CARDS ELIBC FCDSL_CARDS FOO2ZJS_DEVICES FRITZCAPI_CARDS GPSD_PROTOCOLS GRUB_PLATFORMS INPUT_DEVICES KERNEL LCD_DEVICES LINGUAS LIRC_DEVICES MISDN_CARDS NETBEANS_MODULES NGINX_MODULES_HTTP NGINX_MODULES_MAIL OFED_DRIVERS PHP_TARGETS QEMU_SOFTMMU_TARGETS QEMU_USER_TARGETS RUBY_TARGETS SANE_BACKENDS USERLAND VIDEO_CARDS XFCE_PLUGINS XTABLES_ADDONS"
USE_EXPAND_HIDDEN="CROSSCOMPILE_OPTS ELIBC KERNEL USERLAND"
USE_ORDER="env:pkg:conf:defaults:pkginternal:repo:env.d"
VIDEO_CARDS="nvidia"
WINDOWID="33591493"
WINDOWPATH="7"
XAUTHORITY="/home/ssuominen/.Xauthority"
XDG_CONFIG_DIRS="/etc/xdg:/etc/xdg"
XDG_DATA_DIRS="/usr/local/share:/usr/share:/usr/share"
XDG_MENU_PREFIX="xfce-"
XDG_SESSION_COOKIE="bf84194bdec69b2c675851420000000e-1329944652.264907-812343354"
XSESSION="Xfce4"
XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq steal rawnat logmark ipmark dhcpmac delude chaos account"
_="/usr/bin/emerge"
Comment 1 Samuli Suominen (RETIRED) gentoo-dev 2012-03-01 21:29:31 UTC
Created attachment 303885 [details]
backtrace

sorry, the old backtrace was gv itself missing debug symbols.
Comment 2 Samuli Suominen (RETIRED) gentoo-dev 2012-03-01 21:32:24 UTC
[ebuild   R    ] x11-libs/libX11-1.4.4  USE="ipv6 -doc -static-libs -test" 0 kB
[ebuild   R    ] x11-libs/libXaw3d-1.6.1-r1  USE="unicode -static-libs" 0 kB
[ebuild   R    ] app-text/gv-3.7.3-r1  USE="unicode -xinerama" 0 kB
Comment 3 Matt Turner gentoo-dev 2012-03-01 21:53:36 UTC
Created attachment 303887 [details, diff]
patch

Fixes the crash for me. I'm not sure why I wasn't able to reproduce it earlier when you told me about it.

Also strange is that this code is exactly the same in 1.5.
Comment 4 Samuli Suominen (RETIRED) gentoo-dev 2012-03-01 23:54:51 UTC
FTR, the new patch works fine
Comment 5 Samuli Suominen (RETIRED) gentoo-dev 2012-03-05 09:44:02 UTC
http://lists.x.org/archives/xorg-devel/2012-March/029639.html

Since the patch is already on xorg-devel ML and got some reviews, pushed this to tree

+*libXaw3d-1.6.1-r1 (05 Mar 2012)
+
+  05 Mar 2012; Samuli Suominen <ssuominen@gentoo.org>
+  +libXaw3d-1.6.1-r1.ebuild, +files/libXaw3d-1.6.1-use_after_free.patch:
+  Fix use after free in DestroyAllIM (causing segmentation fault in app-text/gv
+  exit) wrt #406487 by Matt Turner