Stop crashes when bad font names received from XServer. [Bug 1475865]

1 files changed, 20 insertions, 3 deletions

diff --git a/unix/tkUnixFont.c b/unix/tkUnixFont.c
index e4718d8..9140023 100644
--- a/unix/tkUnixFont.c
+++ b/unix/tkUnixFont.c
@@ -9,7 +9,7 @@
  * See the file "license.terms" for information on usage and redistribution of
  * this file, and for a DISCLAIMER OF ALL WARRANTIES.
  *
- * RCS: @(#) $Id: tkUnixFont.c,v 1.27 2006/03/22 00:21:19 das Exp $
+ * RCS: @(#) $Id: tkUnixFont.c,v 1.28 2006/04/25 08:18:31 dkf Exp $
  */
 
 #include "tkUnixInt.h"
@@ -844,8 +844,25 @@ TkpGetFontFamilies(
     Tcl_InitHashTable(&familyTable, TCL_STRING_KEYS);
     nameList = ListFonts(Tk_Display(tkwin), "*", &numNames);
     for (i = 0; i < numNames; i++) {
-	family = strchr(nameList[i] + 1, '-') + 1;
-	strchr(family, '-')[0] = '\0';
+	char *familyEnd;
+
+	family = strchr(nameList[i] + 1, '-');
+	if (family == NULL) {
+	    /*
+	     * Apparently, sometimes ListFonts() can return a font name with
+	     * zero or one '-' character in it. This is probably indicative of
+	     * a server misconfiguration, but crashing because of it is a very
+	     * bad idea anyway. [Bug 1475865]
+	     */
+
+	    continue;
+	}
+	family++;			/* Advance to char after '-'. */
+	familyEnd = strchr(family, '-');
+	if (familyEnd == NULL) {
+	    continue;			/* See comment above. */
+	}
+	*familyEnd = '\0';
 	Tcl_CreateHashEntry(&familyTable, family, &new);
     }
     XFreeFontNames(nameList);