ports/129326: x11-clocks/asclock dies due to buffer overrun at startup

[G. Paul Ziemba]

>Number:         129326
>Category:       ports
>Synopsis:       x11-clocks/asclock dies due to buffer overrun at startup
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-ports-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Mon Dec 01 08:30:01 UTC 2008
>Closed-Date:
>Last-Modified:
>Originator:     G. Paul Ziemba
>Release:        7.1-PRERELEASE
>Organization:
>Environment:
FreeBSD hairball.ziemba.us 7.1-PRERELEASE FreeBSD 7.1-PRERELEASE #0: Tue Nov 18 13:50:14 PST 2008     root at hairball:/usr/obj/usr/src/sys/GPZ-081118  i386
>Description:
asclock dies immediately with error "not enough free color cells"
>How-To-Repeat:
$ asclock
not enough free color cells
$
>Fix:
"not enough free color cells" is erroneously printed for any error returned by XpmCreatePixmapFromData, e.g., corrupt xpm data.

The actual cause of the error in this case was a buffer overrun when constructing the LED pixmap data.

Attached patch addresses several things:
1 - buffer overrun
2 - simplified bizarre method of printing with format %04X
3 - error messages match actual errors from XpmCreatePixmapFromData
4 - missing error test for one call to XpmCreatePixmapFromData


Patch attached with submission follows:

--- asclock.c
+++ work/asclock/asclock.c	2008-11-30 23:32:41.000000000 -0800
@@ -302,8 +302,8 @@
   static char **clock_xpm;
   XColor col;
   XWindowAttributes attributes;
-  char led1[22];
-  char led2[22];
+  char led1[64];
+  char led2[64];
   int ret;
 
   clock_xpm =ONLYSHAPE ? mask_xpm : clk_xpm;
@@ -317,51 +317,49 @@
       nocolor("parse",LedColor);
     }
 
-  sprintf(&led1[0], ".      c #%4X%4X%4X", col.red, col.green, col.blue);
-  for(ret=10;ret<22;ret++)
-    if(led1[ret]==' ') led1[ret]='0';
-  led_xpm[2] = &led1[0];
+  sprintf(led1, ".      c #%04X%04X%04X", col.red, col.green, col.blue);
+  led_xpm[2] = led1;
 
   col.red   = (col.red  /10) *3;
   col.green = (col.green/10) *3;
   col.blue  = (col.blue /10) *3;
-  sprintf(&led2[0], "X      c #%4X%4X%4X", col.red, col.green, col.blue);
-  for(ret=10;ret<22;ret++)
-    if(led2[ret]==' ') led2[ret]='0';
-  led_xpm[3] = &led2[0];
+  sprintf(led2, "X      c #%04X%04X%04X", col.red, col.green, col.blue);
+  led_xpm[3] = led2;
 
   asclock.attributes.valuemask |= (XpmReturnPixels | XpmReturnExtensions);
   ret = XpmCreatePixmapFromData(dpy, Root, clock_xpm, &asclock.pixmap, 
 				&asclock.mask, &asclock.attributes);
   if(ret != XpmSuccess)
-    {fprintf(stderr, ERR_colorcells);exit(1);}
+    {fprintf(stderr, "1: %s\n", XpmGetErrorString(ret));exit(1);}
   visible.attributes.valuemask |= (XpmReturnPixels | XpmReturnExtensions);
   ret = XpmCreatePixmapFromData(dpy, Root, clk_xpm, &visible.pixmap, 
 				&visible.mask, &visible.attributes);
+  if(ret != XpmSuccess)
+    {fprintf(stderr, "2: %s\n", XpmGetErrorString(ret));exit(1);}
 
   led.attributes.valuemask |= (XpmReturnPixels | XpmReturnExtensions);
   ret = XpmCreatePixmapFromData(dpy, Root, led_xpm, &led.pixmap, 
 				&led.mask, &led.attributes);
   if(ret != XpmSuccess)
-    {fprintf(stderr, ERR_colorcells);exit(1);}
+    {fprintf(stderr, "3: %s\n", XpmGetErrorString(ret));exit(1);}
 
   month.attributes.valuemask |= (XpmReturnPixels | XpmReturnExtensions);
   ret = XpmCreatePixmapFromData(dpy, Root, month_xpm, &month.pixmap, 
 				&month.mask, &month.attributes);
   if(ret != XpmSuccess)
-    {fprintf(stderr, ERR_colorcells);exit(1);}
+    {fprintf(stderr, "4: %s\n", XpmGetErrorString(ret));exit(1);}
 
   date.attributes.valuemask |= (XpmReturnPixels | XpmReturnExtensions);
   ret = XpmCreatePixmapFromData(dpy, Root, date_xpm, &date.pixmap, 
 				&date.mask, &date.attributes);
   if(ret != XpmSuccess)
-    {fprintf(stderr, ERR_colorcells);exit(1);}
+    {fprintf(stderr, "5: %s\n", XpmGetErrorString(ret));exit(1);}
 
   weekday.attributes.valuemask |= (XpmReturnPixels | XpmReturnExtensions);
   ret = XpmCreatePixmapFromData(dpy, Root, weekday_xpm, &weekday.pixmap, 
 				&weekday.mask, &weekday.attributes);
   if(ret != XpmSuccess)
-    {fprintf(stderr, ERR_colorcells);exit(1);}
+    {fprintf(stderr, "6: %s\n", XpmGetErrorString(ret));exit(1);}
 }
 /****************************************************************************/
 /* Removes expose events for a specific window from the queue */


>Release-Note:
>Audit-Trail:
>Unformatted: