Andrew Kesterson
fb58bb01b0
Six findings, all of them libakgl's, all closed. The memcheck run is clean. Not one of the four json_load_file calls in src/ was ever matched by a json_decref, so every asset load abandoned its parsed document: 1.5 KB per sprite, 2.1 KB per character, 9 KB per load of the 2x2 fixture map, and on the order of a megabyte for a real one. Each loader now releases it in the CLEANUP block it already had, on the success path as well as the failure one. akgl_registry_load_properties needed its loop moved inside the ATTEMPT block first: props is a borrowed reference into the document and is read after the block ends, so every exit from that loop leaked the whole tree. akgl_get_property copied a fixed AKGL_MAX_STRING_LENGTH bytes out of what SDL handed back, which is SDL's strdup of the value -- four bytes for "0.0". That read up to 4 KiB past the end of somebody else's allocation on every property read, returned whatever was there past the terminator, and would have faulted on a value that landed at the end of a page. It copies the value and its terminator now, and refuses a value too long for an akgl_String rather than truncating it into an unterminated buffer. The header note that described the overread as a quirk describes correct behaviour instead. The four savegame name tables wrote a fixed-width field starting at the registry key, and SDL sizes that allocation to the name. They read past it on every entry and put what they found into the save file: up to half a kilobyte of this process's heap per registered object, in a file a player might send to somebody. They stage through a zeroed buffer now, and a negative-array-size typedef fails the build if a table's width ever outgrows it. akgl_controller_list_keyboards never freed the array SDL_GetKeyboards allocated for it. A font could be opened and published and never handed back -- there was no way to close one, so a game that changed fonts between scenes leaked ten kilobytes each time, and loading over a live name leaked the font it displaced. akgl_text_unloadfont is that missing half, and akgl_text_loadfont calls it when it replaces a name, after the new font has opened so a failed reload leaves the caller with the font they had. A new public symbol takes the version to 0.4.0 and the soname with it: an 0.3 consumer cannot be handed this library and told it is the same ABI. tests/registry.c fills a destination with a sentinel and asserts the bytes past the terminator survive a read, which fails against the old copy. tests/text.c covers unload, double unload, unloading a name that was never registered, and replacement closing the displaced font. The JSON releases have no test of their own and cannot sensibly have one -- nothing in the public API can observe a jansson refcount -- so the memcheck run is their test, which is an argument for gating it rather than against. The two remaining findings are in deps/semver's own unit test, which is vendored. They are suppressed by function name, so a rewrite of those cases comes back as a finding. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
86 lines
3.3 KiB
Plaintext
86 lines
3.3 KiB
Plaintext
# Valgrind suppressions for the libakgl memory-check run.
|
|
#
|
|
# Used by `cmake --build build --target memcheck` and by any hand-run
|
|
# `ctest -T memcheck`; see AGENTS.md -> "Memory checking".
|
|
#
|
|
# Every entry here is a deliberate decision that a finding belongs to somebody
|
|
# else's code and cannot be fixed from this repository. Nothing that libakgl
|
|
# allocates is suppressed, and nothing is suppressed merely because it is noisy.
|
|
# If a suppression starts hiding a real finding, delete it -- a false negative in
|
|
# a leak check is worth more than a quiet log.
|
|
#
|
|
# The memcheck target runs the suite headless (SDL_VIDEO_DRIVER=dummy,
|
|
# SDL_RENDER_DRIVER=software, SDL_AUDIO_DRIVER=dummy) precisely so that the GPU
|
|
# stack is never loaded. That removes thousands of unfixable findings inside
|
|
# amdgpu_dri.so / Mesa / libGLX without suppressing anything, which is why there
|
|
# are no driver entries below. Run the suite against a real driver and you will
|
|
# need them; do not add them here on that account.
|
|
|
|
# SDL allocates its global state -- the hint table, the property registry, the
|
|
# log category array, the clipboard -- on first use and reclaims it in SDL_Quit.
|
|
# A test that fails before SDL_Quit, and every test that deliberately leaves SDL
|
|
# up so a later assertion can look at it, leaves those blocks behind. They are
|
|
# one-per-process, not per-call, so they cannot accumulate into a leak.
|
|
{
|
|
sdl3-global-state-still-reachable
|
|
Memcheck:Leak
|
|
match-leak-kinds: reachable
|
|
...
|
|
fun:SDL_InitSubSystem_REAL
|
|
}
|
|
|
|
# dlopen keeps the link map and the loaded objects' TLS blocks for the process
|
|
# lifetime; a dlclose does not return them. SDL loads its video, audio, and
|
|
# render backends this way, and SDL_image and SDL_mixer load their codecs the
|
|
# same way.
|
|
{
|
|
dl-open-keeps-its-link-map
|
|
Memcheck:Leak
|
|
match-leak-kinds: reachable,possible
|
|
...
|
|
fun:_dl_open
|
|
}
|
|
|
|
# FreeType, reached through SDL_ttf, caches per-face and per-size structures
|
|
# inside the library instance and frees them in FT_Done_FreeType, which SDL_ttf
|
|
# calls from TTF_Quit. A suite that opens a font and exits without TTF_Quit
|
|
# reports them; a font libakgl itself failed to close is a different finding and
|
|
# is NOT covered here -- it appears under akgl_text_loadfont, not under
|
|
# FT_Init_FreeType.
|
|
{
|
|
freetype-library-instance
|
|
Memcheck:Leak
|
|
match-leak-kinds: reachable
|
|
...
|
|
fun:FT_Init_FreeType
|
|
}
|
|
|
|
# deps/semver's own unit test leaks the buffers it cuts strings into --
|
|
# semver_unit.c:8 and :21, one calloc each per case. Vendored code, and its test
|
|
# program at that: not ours to edit, and not worth carrying a local patch for.
|
|
# Named by function rather than by file so that a rewrite of those cases stops
|
|
# being suppressed and comes back as a finding.
|
|
#
|
|
# This is the only entry here that hides a real leak in a program this build
|
|
# runs. It is bounded, it is in a test, and the alternative is either a fork of
|
|
# a vendored dependency or a memcheck run that is always red -- see TODO.md,
|
|
# "Memory checking" item 39.
|
|
{
|
|
vendored-semver-unit-test-strcut-first
|
|
Memcheck:Leak
|
|
match-leak-kinds: definite
|
|
fun:calloc
|
|
fun:test_strcut_first
|
|
fun:test_strcut
|
|
fun:main
|
|
}
|
|
{
|
|
vendored-semver-unit-test-strcut-second
|
|
Memcheck:Leak
|
|
match-leak-kinds: definite
|
|
fun:calloc
|
|
fun:test_strcut_second
|
|
fun:test_strcut
|
|
fun:main
|
|
}
|