Fix [a953736b546ce681cbfc]: Potential wrong use of TkKeyEvent. Finally done what's suggested there: Since kePtr->charValuePtr is only used on X11, only do the ckfree(kePtr->charValuePtr) on X11.

On Win32, use TkKeyEvent in stead of the non-standard XEvent. On macOS TkKeyEvent
is not used, so no change is needed (- MC).

6 files changed, 91 insertions, 81 deletions

diff --git a/generic/tkEvent.c b/generic/tkEvent.c
index 0beb8b6..a2fa293 100644
--- a/generic/tkEvent.c
+++ b/generic/tkEvent.c
@@ -1751,13 +1751,15 @@ CleanUpTkEvent(
     switch (eventPtr->type) {
     case KeyPress:
     case KeyRelease: {
-	TkKeyEvent *kePtr = (TkKeyEvent *) eventPtr;
 
+#if !defined(_WIN32) && !defined(MAC_OSX_TK)
+	TkKeyEvent *kePtr = (TkKeyEvent *) eventPtr;
 	if (kePtr->charValuePtr != NULL) {
 	    ckfree(kePtr->charValuePtr);
 	    kePtr->charValuePtr = NULL;
 	    kePtr->charValueLen = 0;
 	}
+#endif
 	break;
     }
 
diff --git a/generic/tkInt.h b/generic/tkInt.h
index 8f958ab..d90cb0e 100644
--- a/generic/tkInt.h
+++ b/generic/tkInt.h
@@ -852,6 +852,11 @@ typedef struct TkWindow {
 
 typedef struct {
     XKeyEvent keyEvent;		/* The real event from X11. */
+#ifdef _WIN32
+    char trans_chars[XMaxTransChars];
+                            /* translated characters */
+    unsigned char nbytes;
+#else
     char *charValuePtr;		/* A pointer to a string that holds the key's
 				 * %A substitution text (before backslash
 				 * adding), or NULL if that has not been
@@ -861,6 +866,7 @@ typedef struct {
 				 * is non-NULL. */
     KeySym keysym;		/* Key symbol computed after input methods
 				 * have been invoked */
+#endif
 } TkKeyEvent;
 
 /*
diff --git a/win/tkWinKey.c b/win/tkWinKey.c
index c7fa20c..4451296 100644
--- a/win/tkWinKey.c
+++ b/win/tkWinKey.c
@@ -102,9 +102,10 @@ TkpGetString(
 
     Tcl_DStringInit(dsPtr);
     if (keyEv->send_event == -1) {
-	if (keyEv->nbytes > 0) {
+	TkKeyEvent *ev = (TkKeyEvent *)keyEv;
+	if (ev->nbytes > 0) {
 	    Tcl_ExternalToUtfDString(TkWinGetKeyInputEncoding(),
-		    keyEv->trans_chars, keyEv->nbytes, dsPtr);
+		    ev->trans_chars, ev->nbytes, dsPtr);
 	}
     } else if (keyEv->send_event == -3) {
 
diff --git a/win/tkWinMenu.c b/win/tkWinMenu.c
index daf32ec..18ef441 100644
--- a/win/tkWinMenu.c
+++ b/win/tkWinMenu.c
@@ -2229,17 +2229,16 @@ TkWinMenuKeyObjCmd(
 	    virtualKey = XKeysymToKeycode(winPtr->display, keySym);
 	    scanCode = MapVirtualKeyW(virtualKey, 0);
 	    if (0 != scanCode) {
-		XKeyEvent xkey = eventPtr->xkey;
+		TkKeyEvent xkey;
+		memcpy(&xkey, eventPtr, sizeof(xkey));
 		CallWindowProcW(DefWindowProcW, Tk_GetHWND(Tk_WindowId(tkwin)),
 			WM_SYSKEYDOWN, virtualKey,
 			(int) ((scanCode << 16) | (1 << 29)));
-		if (xkey.nbytes > 0) {
-		    for (i = 0; i < xkey.nbytes; i++) {
-			CallWindowProcW(DefWindowProcW,
-				Tk_GetHWND(Tk_WindowId(tkwin)), WM_SYSCHAR,
-				xkey.trans_chars[i],
-				(int) ((scanCode << 16) | (1 << 29)));
-		    }
+		for (i = 0; i < xkey.nbytes; i++) {
+		    CallWindowProcW(DefWindowProcW,
+			    Tk_GetHWND(Tk_WindowId(tkwin)), WM_SYSCHAR,
+			    xkey.trans_chars[i],
+			    (int) ((scanCode << 16) | (1 << 29)));
 		}
 	    }
 	}
diff --git a/win/tkWinX.c b/win/tkWinX.c
index 689268d..739712b 100644
--- a/win/tkWinX.c
+++ b/win/tkWinX.c
@@ -104,7 +104,7 @@ static Tcl_ThreadDataKey dataKey;
 static void		GenerateXEvent(HWND hwnd, UINT message,
 			    WPARAM wParam, LPARAM lParam);
 static unsigned int	GetState(UINT message, WPARAM wParam, LPARAM lParam);
-static void 		GetTranslatedKey(XKeyEvent *xkey, UINT type);
+static void 		GetTranslatedKey(TkKeyEvent *xkey, UINT type);
 static void		UpdateInputLanguage(int charset);
 static int		HandleIMEComposition(HWND hwnd, LPARAM lParam);
 
@@ -994,7 +994,7 @@ GenerateXEvent(
     WPARAM wParam,
     LPARAM lParam)
 {
-    XEvent event;
+    union {XEvent x; TkKeyEvent key;} event;
     TkWindow *winPtr;
     ThreadSpecificData *tsdPtr = (ThreadSpecificData *)
 	    Tcl_GetThreadData(&dataKey, sizeof(ThreadSpecificData));
@@ -1020,33 +1020,33 @@ GenerateXEvent(
 	return;
     }
 
-    memset(&event, 0, sizeof(XEvent));
-    event.xany.serial = winPtr->display->request++;
-    event.xany.send_event = False;
-    event.xany.display = winPtr->display;
-    event.xany.window = winPtr->window;
+    memset(&event.x, 0, sizeof(XEvent));
+    event.x.xany.serial = winPtr->display->request++;
+    event.x.xany.send_event = False;
+    event.x.xany.display = winPtr->display;
+    event.x.xany.window = winPtr->window;
 
     switch (message) {
     case WM_PAINT: {
 	PAINTSTRUCT ps;
 
-	event.type = Expose;
+	event.x.type = Expose;
 	BeginPaint(hwnd, &ps);
-	event.xexpose.x = ps.rcPaint.left;
-	event.xexpose.y = ps.rcPaint.top;
-	event.xexpose.width = ps.rcPaint.right - ps.rcPaint.left;
-	event.xexpose.height = ps.rcPaint.bottom - ps.rcPaint.top;
+	event.x.xexpose.x = ps.rcPaint.left;
+	event.x.xexpose.y = ps.rcPaint.top;
+	event.x.xexpose.width = ps.rcPaint.right - ps.rcPaint.left;
+	event.x.xexpose.height = ps.rcPaint.bottom - ps.rcPaint.top;
 	EndPaint(hwnd, &ps);
-	event.xexpose.count = 0;
+	event.x.xexpose.count = 0;
 	break;
     }
 
     case WM_CLOSE:
-	event.type = ClientMessage;
-	event.xclient.message_type =
+	event.x.type = ClientMessage;
+	event.x.xclient.message_type =
 		Tk_InternAtom((Tk_Window) winPtr, "WM_PROTOCOLS");
-	event.xclient.format = 32;
-	event.xclient.data.l[0] =
+	event.x.xclient.format = 32;
+	event.x.xclient.data.l[0] =
 		Tk_InternAtom((Tk_Window) winPtr, "WM_DELETE_WINDOW");
 	break;
 
@@ -1082,10 +1082,10 @@ GenerateXEvent(
 	    return;
 	}
 
-	event.xany.window = winPtr->window;
-	event.type = (message == WM_SETFOCUS) ? FocusIn : FocusOut;
-	event.xfocus.mode = NotifyNormal;
-	event.xfocus.detail = NotifyNonlinear;
+	event.x.xany.window = winPtr->window;
+	event.x.type = (message == WM_SETFOCUS) ? FocusIn : FocusOut;
+	event.x.xfocus.mode = NotifyNormal;
+	event.x.xfocus.detail = NotifyNonlinear;
 
 	/*
 	 * Destroy the caret if we own it. If we are moving to another Tk
@@ -1107,10 +1107,10 @@ GenerateXEvent(
 
 	    return;
 	}
-	event.type = SelectionClear;
-	event.xselectionclear.selection =
+	event.x.type = SelectionClear;
+	event.x.xselectionclear.selection =
 		Tk_InternAtom((Tk_Window)winPtr, "CLIPBOARD");
-	event.xselectionclear.time = TkpGetMS();
+	event.x.xselectionclear.time = TkpGetMS();
 	break;
 
     case WM_MOUSEWHEEL:
@@ -1139,15 +1139,15 @@ GenerateXEvent(
 	 * Set up the common event fields.
 	 */
 
-	event.xbutton.root = RootWindow(winPtr->display, winPtr->screenNum);
-	event.xbutton.subwindow = None;
-	event.xbutton.x = clientPoint.x;
-	event.xbutton.y = clientPoint.y;
-	event.xbutton.x_root = root.point.x;
-	event.xbutton.y_root = root.point.y;
-	event.xbutton.state = state;
-	event.xbutton.time = time;
-	event.xbutton.same_screen = True;
+	event.x.xbutton.root = RootWindow(winPtr->display, winPtr->screenNum);
+	event.x.xbutton.subwindow = None;
+	event.x.xbutton.x = clientPoint.x;
+	event.x.xbutton.y = clientPoint.y;
+	event.x.xbutton.x_root = root.point.x;
+	event.x.xbutton.y_root = root.point.y;
+	event.x.xbutton.state = state;
+	event.x.xbutton.time = time;
+	event.x.xbutton.same_screen = True;
 
 	/*
 	 * Now set up event specific fields.
@@ -1179,10 +1179,10 @@ GenerateXEvent(
 	     * TkpGetString. [Bug 1118340].
 	     */
 
-	    event.type = MouseWheelEvent;
-	    event.xany.send_event = -1;
-	    event.xkey.nbytes = 0;
-	    event.xkey.keycode = tsdPtr->vWheelAcc / WHEEL_DELTA * WHEEL_DELTA;
+	    event.x.type = MouseWheelEvent;
+	    event.x.xany.send_event = -1;
+	    event.key.nbytes = 0;
+	    event.x.xkey.keycode = tsdPtr->vWheelAcc / WHEEL_DELTA * WHEEL_DELTA;
 	    tsdPtr->vWheelAcc = tsdPtr->vWheelAcc % WHEEL_DELTA;
 	    break;
 	}
@@ -1211,11 +1211,11 @@ GenerateXEvent(
 	     * TkpGetString. [Bug 1118340].
 	     */
 
-	    event.type = MouseWheelEvent;
-	    event.xany.send_event = -1;
-	    event.xkey.nbytes = 0;
-	    event.xkey.state |= ShiftMask;
-	    event.xkey.keycode = tsdPtr->hWheelAcc / WHEEL_DELTA * WHEEL_DELTA;
+	    event.x.type = MouseWheelEvent;
+	    event.x.xany.send_event = -1;
+	    event.key.nbytes = 0;
+	    event.x.xkey.state |= ShiftMask;
+	    event.x.xkey.keycode = tsdPtr->hWheelAcc / WHEEL_DELTA * WHEEL_DELTA;
 	    tsdPtr->hWheelAcc = tsdPtr->hWheelAcc % WHEEL_DELTA;
 	    break;
 	}
@@ -1229,10 +1229,10 @@ GenerateXEvent(
 	     * MBCS characters that came from the TranslateMessage call.
 	     */
 
-	    event.type = KeyPress;
-	    event.xany.send_event = -1;
-	    event.xkey.keycode = wParam;
-	    GetTranslatedKey(&event.xkey, (message == WM_KEYDOWN) ? WM_CHAR :
+	    event.x.type = KeyPress;
+	    event.x.xany.send_event = -1;
+	    event.x.xkey.keycode = wParam;
+	    GetTranslatedKey(&event.key, (message == WM_KEYDOWN) ? WM_CHAR :
 	            WM_SYSCHAR);
 	    break;
 
@@ -1244,9 +1244,9 @@ GenerateXEvent(
 	     * WM_CHAR messages which will follow.
 	     */
 
-	    event.type = KeyRelease;
-	    event.xkey.keycode = wParam;
-	    event.xkey.nbytes = 0;
+	    event.x.type = KeyRelease;
+	    event.x.xkey.keycode = wParam;
+	    event.key.nbytes = 0;
 	    break;
 
 	case WM_CHAR:
@@ -1280,9 +1280,9 @@ GenerateXEvent(
 	     *    character.
 	     */
 
-	    event.type = KeyPress;
-	    event.xany.send_event = -1;
-	    event.xkey.keycode = 0;
+	    event.x.type = KeyPress;
+	    event.x.xany.send_event = -1;
+	    event.x.xkey.keycode = 0;
 	    if ((int)wParam & 0xff00) {
 		int ch1 = wParam & 0xffff;
 
@@ -1295,12 +1295,12 @@ GenerateXEvent(
 			    (ch1 & 0x3ff) | 0x10000;
 		    tsdPtr->surrogateBuffer = 0;
 		}
-		event.xany.send_event = -3;
-		event.xkey.nbytes = 0;
-		event.xkey.keycode = ch1;
+		event.x.xany.send_event = -3;
+		event.key.nbytes = 0;
+		event.x.xkey.keycode = ch1;
 	    } else {
-		event.xkey.nbytes = 1;
-		event.xkey.trans_chars[0] = (char) wParam;
+		event.key.nbytes = 1;
+		event.key.trans_chars[0] = (char) wParam;
 
 		if (IsDBCSLeadByte((BYTE) wParam)) {
 		    MSG msg;
@@ -1309,22 +1309,22 @@ GenerateXEvent(
 		            PM_NOREMOVE) != 0)
 			    && (msg.message == WM_CHAR)) {
 			GetMessageW(&msg, NULL, WM_CHAR, WM_CHAR);
-			event.xkey.nbytes = 2;
-			event.xkey.trans_chars[1] = (char) msg.wParam;
+			event.key.nbytes = 2;
+			event.key.trans_chars[1] = (char) msg.wParam;
 		   }
 		}
 	    }
-	    Tk_QueueWindowEvent(&event, TCL_QUEUE_TAIL);
-	    event.type = KeyRelease;
+	    Tk_QueueWindowEvent(&event.x, TCL_QUEUE_TAIL);
+	    event.x.type = KeyRelease;
 	    break;
 
 	case WM_UNICHAR: {
-	    event.type = KeyPress;
-	    event.xany.send_event = -3;
-	    event.xkey.keycode = wParam;
-	    event.xkey.nbytes = 0;
-	    Tk_QueueWindowEvent(&event, TCL_QUEUE_TAIL);
-	    event.type = KeyRelease;
+	    event.x.type = KeyPress;
+	    event.x.xany.send_event = -3;
+	    event.x.xkey.keycode = wParam;
+	    event.key.nbytes = 0;
+	    Tk_QueueWindowEvent(&event.x, TCL_QUEUE_TAIL);
+	    event.x.type = KeyRelease;
 	    break;
 	}
 
@@ -1345,7 +1345,7 @@ GenerateXEvent(
      * Post the translated event to the main Tk event queue.
      */
 
-    Tk_QueueWindowEvent(&event, TCL_QUEUE_TAIL);
+    Tk_QueueWindowEvent(&event.x, TCL_QUEUE_TAIL);
 }
 
 /*
@@ -1447,7 +1447,7 @@ GetState(
 
 static void
 GetTranslatedKey(
-    XKeyEvent *xkey,
+    TkKeyEvent *xkey,
     UINT type)
 {
     MSG msg;
@@ -1470,7 +1470,7 @@ GetTranslatedKey(
 	 */
 
 	if ((msg.message == WM_CHAR) && (msg.lParam & 0x20000000)) {
-	    xkey->state = 0;
+	    xkey->keyEvent.state = 0;
 	}
 	xkey->trans_chars[xkey->nbytes++] = (char) msg.wParam;
 
diff --git a/xlib/X11/Xlib.h b/xlib/X11/Xlib.h
index af8f706..f3ee13d 100644
--- a/xlib/X11/Xlib.h
+++ b/xlib/X11/Xlib.h
@@ -549,9 +549,11 @@ typedef struct {
 	unsigned int state;	/* key or button mask */
 	unsigned int keycode;	/* detail */
 	Bool same_screen;	/* same screen flag */
+#ifdef MAC_OSX_TK /* Only used on MacOSX. To be removed. */
 	char trans_chars[XMaxTransChars];
 				/* translated characters */
 	unsigned char nbytes;
+#endif
 } XKeyEvent;
 typedef XKeyEvent XKeyPressedEvent;
 typedef XKeyEvent XKeyReleasedEvent;