andrew/libakgl
1
0
Fork 0
Code Issues 66 Pull Requests 1 Actions 1 Packages Projects Releases Wiki Activity

Fix every memory defect the checker found, and bump to 0.4.0

Browse Source 
Six findings, all of them libakgl's, all closed. The memcheck run is clean.

Not one of the four json_load_file calls in src/ was ever matched by a
json_decref, so every asset load abandoned its parsed document: 1.5 KB per
sprite, 2.1 KB per character, 9 KB per load of the 2x2 fixture map, and on
the order of a megabyte for a real one. Each loader now releases it in the
CLEANUP block it already had, on the success path as well as the failure
one. akgl_registry_load_properties needed its loop moved inside the ATTEMPT
block first: props is a borrowed reference into the document and is read
after the block ends, so every exit from that loop leaked the whole tree.

akgl_get_property copied a fixed AKGL_MAX_STRING_LENGTH bytes out of what
SDL handed back, which is SDL's strdup of the value -- four bytes for
"0.0". That read up to 4 KiB past the end of somebody else's allocation on
every property read, returned whatever was there past the terminator, and
would have faulted on a value that landed at the end of a page. It copies
the value and its terminator now, and refuses a value too long for an
akgl_String rather than truncating it into an unterminated buffer. The
header note that described the overread as a quirk describes correct
behaviour instead.

The four savegame name tables wrote a fixed-width field starting at the
registry key, and SDL sizes that allocation to the name. They read past it
on every entry and put what they found into the save file: up to half a
kilobyte of this process's heap per registered object, in a file a player
might send to somebody. They stage through a zeroed buffer now, and a
negative-array-size typedef fails the build if a table's width ever outgrows
it.

akgl_controller_list_keyboards never freed the array SDL_GetKeyboards
allocated for it.

A font could be opened and published and never handed back -- there was no
way to close one, so a game that changed fonts between scenes leaked ten
kilobytes each time, and loading over a live name leaked the font it
displaced. akgl_text_unloadfont is that missing half, and akgl_text_loadfont
calls it when it replaces a name, after the new font has opened so a failed
reload leaves the caller with the font they had. A new public symbol takes
the version to 0.4.0 and the soname with it: an 0.3 consumer cannot be
handed this library and told it is the same ABI.

tests/registry.c fills a destination with a sentinel and asserts the bytes
past the terminator survive a read, which fails against the old copy.
tests/text.c covers unload, double unload, unloading a name that was never
registered, and replacement closing the displaced font. The JSON releases
have no test of their own and cannot sensibly have one -- nothing in the
public API can observe a jansson refcount -- so the memcheck run is their
test, which is an argument for gating it rather than against.

The two remaining findings are in deps/semver's own unit test, which is
vendored. They are suppressed by function name, so a rewrite of those cases
comes back as a finding.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Andrew Kesterson
2026-07-31 15:49:11 -04:00
parent 80fdf2e098
commit fb58bb01b0
14 changed files with 408 additions and 58 deletions
Download Patch File Download Diff File Expand all files Collapse all files

86
TODO.md
View File

@@ -1126,8 +1126,15 @@ nothing about this library.
### Defects the memory checker found
Ordered by blast radius. Numbering continues the lists above. Every size below
is measured, not estimated.
**All six are fixed.** They are kept here rather than deleted because the sizes
are measured and the reasoning is worth having next time somebody asks why a
loader ends in a `CLEANUP` block, or why a name field is staged through a zeroed
buffer. `cmake --build build --target memcheck` is clean, and the CI job that
runs it gates: the next one of these fails the build on the push that
introduces it.
Ordered by blast radius as they were found. Numbering continues the lists above.
Every size below is measured, not estimated.
34. **Every JSON loader leaks its parsed document.** There are four
`json_load_file` calls in `src/` and not one `json_decref` anywhere in the
@@ -1147,11 +1154,14 @@ is measured, not estimated.
death leaks a level's worth of JSON each time, and this is the one item in
this list that grows without bound.
Fix: `json_decref(json)` in the `CLEANUP` block of each, which is where the
other resources are already released. It is four lines. What makes it worth
its own commit rather than a footnote is that each one needs a test proving
the document is released, and `akgl_registry_load_properties` has no test at
all yet.
**Fixed.** `json_decref` in the `CLEANUP` block of each, on the success
path as well as the failure one, with the handle nulled after so a second
pass cannot double-release. `akgl_registry_load_properties` needed its loop
moved inside the `ATTEMPT` block first: `props` is a borrowed reference into
the document and was read after the block ended, so every exit from that
loop leaked the document. The test is the memcheck run -- nothing in the
public API can observe a jansson refcount, and inventing a hook to prove it
would be testing the test.
35. **`akgl_get_property` reads up to 4 KiB past the end of the property
value.** `src/registry.c:181` copies a fixed `AKGL_MAX_STRING_LENGTH` bytes
@@ -1167,11 +1177,14 @@ is measured, not estimated.
SDL's heap and returns garbage past the terminator, and on a value that
lands at the end of a page it is a segfault in a getter.
Fix: bound the copy by `strlen` of the source, still capped at
`AKGL_MAX_STRING_LENGTH`. Touches `akgl_get_property` only, and the header
note becomes a description of correct behaviour instead of a confession.
Worth a test that stores a short property, reads it back, and asserts the
bytes after the terminator in the destination are untouched.
**Fixed.** The copy is bounded by the value's own length plus its
terminator, and a value too long for an akgl_String is now refused with
AKERR_OUTOFBOUNDS instead of silently truncated. The documented
AKERR_NULLPOINTER for "unset with no default" is unchanged -- it is raised
deliberately now rather than arriving from inside `aksl_memcpy`.
`tests/registry.c` fills the destination with a sentinel, reads a
three-byte property back, and asserts every byte past the terminator still
holds the sentinel; that assertion fails against the old code.
36. **The savegame name tables read past the end of every registry key, and
write what they find into the file.** `akgl_game_save_actorname_iterator`
@@ -1189,9 +1202,13 @@ is measured, not estimated.
registered object — anything that happened to be next to the key. That is a
file a player might send someone.
Fix: copy the name into a zeroed fixed-width buffer and write that. It
pairs naturally with **Defects -> Known and still open** item 7, which is
the same tables disagreeing about their widths between writer and reader.
**Fixed.** All four iterators now write through `write_name_field`, which
stages the key into a zeroed fixed-width buffer, so the padding is
deterministic and nothing but the name leaves the process. A
negative-array-size typedef fails the build if any of the four widths ever
outgrows the staging buffer. Still open and unrelated to the overread:
**Defects -> Known and still open** item 7, the same tables disagreeing
about their widths between writer and reader.
37. **`akgl_controller_list_keyboards` leaks the array SDL gives it.**
`src/controller.c:188` calls `SDL_GetKeyboards`, which allocates, and never
@@ -1199,10 +1216,10 @@ is measured, not estimated.
— one keyboard id — but it is per call, and the function is shaped like
something a game calls when a device is hotplugged.
Fix: one `SDL_free`, in a `CLEANUP` block so the early-return path is
covered too. The same question should be asked of every SDL enumeration in
`src/controller.c`; `SDL_GetGamepads` has the same contract and the dummy
driver reports no gamepads, so no test reaches it.
**Fixed.** One `SDL_free`, in a `CLEANUP` block so a failure inside the
loop cannot take the array with it. Still worth asking the same question of
every SDL enumeration in `src/controller.c`: `SDL_GetGamepads` has the same
contract, and the dummy driver reports no gamepads, so no test reaches it.
38. **A font, once loaded, is never freed and cannot be.**
`akgl_text_loadfont` (`src/text.c:20`) opens a `TTF_Font`, puts the pointer
@@ -1212,19 +1229,36 @@ is measured, not estimated.
them SDL_ttf's, the rest FreeType's.
This is bounded by how many fonts a game loads, so it is not the runaway
that item 34 is. It is still a gap in the API rather than only a leak: a
game that switches fonts between scenes, or a tool like `charviewer` that
reloads one while the user picks a size, has no way to give the old one
back. Fix: `akgl_text_unloadfont(char *name)` that clears the registry entry
and calls `TTF_CloseFont`, and a matching sweep at shutdown.
that item 34 is. It was a gap in the API rather than only a leak: a game
that switches fonts between scenes, or a tool like `charviewer` that reloads
one while the user picks a size, had no way to give the old one back.
**Fixed**, and this one is a new public symbol rather than a repair:
`akgl_text_unloadfont(char *name)` clears the registry entry and closes the
font. `akgl_text_loadfont` calls it when it replaces a live name, which
closes the second leak the header used to document as intended behaviour --
but only after the new font has opened, so a failed reload leaves the caller
with the font they already had. The version goes to 0.4.0 with it: an 0.3
consumer cannot be handed this library and told it is the same ABI.
Still open: nothing closes the registry's remaining fonts at shutdown. A
game that exits without unloading leaks them exactly once, which valgrind
reports against the process rather than against a loop, and which
`akgl_game_shutdown` would be the natural home for if it existed.
39. **Vendored `deps/semver`'s own unit test leaks 188 bytes** across 16 blocks,
from the `calloc`s in `test_strcut_first` and `test_strcut_second`
(`deps/semver/semver_unit.c:8` and `:21`). Not libakgl's code and not
libakgl's to fix; recorded so that nobody re-diagnoses it, and because
`semver_unit` is registered as one of our CTest tests and so shows up in our
memcheck run. If it becomes noise, the answer is a suppression naming those
two functions, not a local edit to a vendored file.
memcheck run.
**Suppressed**, which is what this list said the answer would be if it ever
became noise, and gating the job made it noise. The two entries in
`scripts/valgrind.supp` name the functions rather than the file, so a
rewrite of those cases stops being suppressed and comes back as a finding.
They are the only entries there that hide a real leak in a program this
build runs; the alternative was a fork of a vendored dependency.
### Not defects, and why