pandory500/SDL-mirror
2
0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Date: Sun, 7 Sep 2008 15:17:00 +0200

Browse source 
From: c2woody@gmx.net
Subject: [SDL] SDL 1.2 doube free/pointer zeroing missing

Hello,

this is about a crash/debug breakage for the current SDL 1.2
source tree (today's svn checkout, same problem in 1.2.13 and
before as far as relevant).
In some places memory is free()d but the associated pointer
is not zeroed, leading to for example double free()s.

For me this happened because SDL_StopEventThread() was executed
twice (during restart of the subsystems), once for the close
down in SDL_VideoQuit() and once at the startup, right at the
beginning of SDL_StartEventLoop(). Thus the code
SDL_DestroyMutex(SDL_EventQ.lock);
(see SDL_events.c) was called twice and executed the SDL_free(mutex);
twice as well, leading to a crash (msvc 64bit for which it was noticed).

I've tried to check all other occurrences of SDL_free and similar
code in msvc, see the attached patch (udiff against revision 4082).
Non-windows only codepaths have neither been checked nor touched.

Comments/ideas welcome.

Attached patch: NULLifies some pointers after they have been free()d.

--HG--
branch : SDL-1.2
extra : convert_revision : svn%3Ac70aab31-4412-0410-b14c-859654838e24/branches/SDL-1.2%403237
This commit is contained in:
Sam Lantinga 2008-11-12 17:23:40 +00:00
parent 94a4eda4c4
commit 3e3345c7fe
6 changed files with 10 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

3
src/audio/SDL_wave.c
View file

@ -440,6 +440,7 @@ SDL_AudioSpec * SDL_LoadWAV_RW (SDL_RWops *src, int freesrc,
do {
if ( chunk.data != NULL ) {
SDL_free(chunk.data);
chunk.data = NULL;
}
lenread = ReadChunk(src, &chunk);
if ( lenread < 0 ) {
@ -522,6 +523,7 @@ SDL_AudioSpec * SDL_LoadWAV_RW (SDL_RWops *src, int freesrc,
do {
if ( *audio_buf != NULL ) {
SDL_free(*audio_buf);
*audio_buf = NULL;
}
lenread = ReadChunk(src, &chunk);
if ( lenread < 0 ) {
@ -591,6 +593,7 @@ static int ReadChunk(SDL_RWops *src, Chunk *chunk)
if ( SDL_RWread(src, chunk->data, chunk->length, 1) != 1 ) {
SDL_Error(SDL_EFREAD);
SDL_free(chunk->data);
chunk->data = NULL;
return(-1);
}
return(chunk->length);