Closed gudzpoz closed 1 month ago
Can confirm the bug and that the PR is working, thanks! Tested on https://github.com/lxqt/lxqt-session/pull/523 the backtrace I got is
Message: Process 288408 (lxqt-session) of user 1004 dumped core.
Stack trace of thread 288408:
#0 0x00007df8f9d144a3 wordfree (libc.so.6 + 0x1054a3)
#1 0x000060d08de88abd n/a (lxqt-session + 0x11abd)
#2 0x000060d08de940db n/a (lxqt-session + 0x1d0db)
#3 0x000060d08de9726f n/a (lxqt-session + 0x2026f)
#4 0x000060d08de854ef n/a (lxqt-session + 0xe4ef)
#5 0x00007df8f978c00f _ZN7QObject5eventEP6QEvent (libQt6Core.so.6 + 0x18c00f)
#6 0x00007df8fa8fc51c _ZN19QApplicationPrivate13notify_helperEP7QObjectP6QEvent (libQt6Widgets.so.6 + 0xfc51c)
When
wordexp
returns non-zero values, thewordexp_t
output is not guaranteed to be in good shape andwordfree
ing it might cause segfaults:This PR checks the return value of
wordexp
and callswordfree
accordingly.Reproduction Steps
lxqt-config-session
and add an enviroment variable likeQT_IM_MODULES=wayland;fcitx;ibus
.~/.config/lxqt/session.conf
for this lineQT_IM_MODULES="wayland;fcitx;ibus"
, and note thatwayland;fcitx;ibus
is an invalid input string forwordexp
.lxqt-session
and observe the segfault.Other details
lxqt-session
installed from the Arch Linux repository differs fromlxqt-session
compiled from source (bothv2.0.0
):Note that
we_wordv
is a null pointer, which seems like garbage value from the uninitializedwordexp_t p
.wordfree
.But this PR should be able to handle both cases.