SDL Double free or corruption error small code segment

Question

my SDL application is crashing sporadically with a very weird error.

glibc is complaining about a "double free or corruption" error and crashing the program. I don't have any multi-threading and the code in question is only freeing a surface that has been allocated in the same static function.

Doing an object dump, I find that the crash is occurring in the following code segment.

Code segment:

static void draw_text_to_screen(const char *text, TTF_Font *text_font,
    SDL_Color text_color, unsigned int x_offset, unsigned int y_offset)
{
    SDL_Rect offset = (SDL_Rect) {x_offset, y_offset, 0, 0};
    SDL_Surface *surface_text =
                    TTF_RenderText_Solid(text_font, text, text_color);
    SDL_BlitSurface(surface_text, NULL, screen, &offset);

    printf("Last thing that is printed\n");
    SDL_FreeSurface(surface_text);
    printf("Not reaching here...\n", surface_text);
}

*** glibc detected *** ./app: double free or corruption (out): 0x0000000002bf82d0 *

======= Backtrace: =========

/lib/x86_64-linux-gnu/libc.so.6(+0x7eb96)[0x7f78a054bb96]

/usr/lib/x86_64-linux-gnu/libSDL-1.2.so.0(SDL_FreeSurface+0xdd)[0x7f78a0cdf9dd]

./app[0x4041da]

./app[0x404985]

./app[0x403322]

./app[0x4036a0]

./app[0x401dd9]

/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xed)[0x7f78a04ee76d]

./app[0x401f25]

======= Memory map: ========

00400000-0040c000 r-xp 00000000 08:05 3805386 /home/me/repos/audio/app

0060b000-0060c000 r--p 0000b000 08:05 3805386 /home/me/repos/audio/app

0060c000-0060d000 rw-p 0000c000 08:05 3805386 /home/me/repos/audio/app

02199000-03307000 rw-p 00000000 00:00 0 [heap]

7f7899461000-7f7899476000 r-xp 00000000 08:05 3804734 /lib/x86_64-linux-gnu/libgcc_s.so.1

7f7899476000-7f7899675000 ---p 00015000 08:05 3804734 /lib/x86_64-linux-gnu/libgcc_s.so.1

7f7899675000-7f7899676000 r--p 00014000 08:05 3804734 /lib/x86_64-linux-gnu/libgcc_s.so.1

7f7899676000-7f7899677000 rw-p 00015000 08:05 3804734 /lib/x86_64-linux-gnu/libgcc_s.so.1

7f7899677000-7f7899ace000 rw-s 00000000 00:04 229377 /SYSV00000000 (deleted)

7f7899ace000-7f7899ad3000 r-xp 00000000 08:05 4857142 /usr/lib/x86_64-linux-gnu/libXfixes.so.3.1.0

7f7899ad3000-7f7899cd2000 ---p 00005000 08:05 4857142 /usr/lib/x86_64-linux-gnu/libXfixes.so.3.1.0

7f7899cd2000-7f7899cd3000 r--p 00004000 08:05 4857142 /usr/lib/x86_64-linux-gnu/libXfixes.so.3.1.0

7f7899cd3000-7f7899cd4000 rw-p 00005000 08:05 4857142 /usr/lib/x86_64-linux-gnu/libXfixes.so.3.1.0

7f7899cd4000-7f7899cdd000 r-xp 00000000 08:05 4857160 /usr/lib/x86_64-linux-gnu/libXrender.so.1.3.0

7f7899cdd000-7f7899edc000 ---p 00009000 08:05 4857160 /usr/lib/x86_64-linux-gnu/libXrender.so.1.3.0

7f7899edc000-7f7899edd000 r--p 00008000 08:05 4857160 /usr/lib/x86_64-linux-gnu/libXrender.so.1.3.0

7f7899edd000-7f7899ede000 rw-p 00009000 08:05 4857160 /usr/lib/x86_64-linux-gnu/libXrender.so.1.3.0

7f7899ede000-7f7899ee7000 r-xp 00000000 08:05 4857134 /usr/lib/x86_64-linux-gnu/libXcursor.so.1.0.2

7f7899ee7000-7f789a0e6000 ---p 00009000 08:05 4857134 /usr/lib/x86_64-linux-gnu/libXcursor.so.1.0.2

7f789a0e6000-7f789a0e7000 r--p 00008000 08:05 4857134 /usr/lib/x86_64-linux-gnu/libXcursor.so.1.0.2

7f789a0e7000-7f789a0e8000 rw-p 00009000 08:05 4857134 /usr/lib/x86_64-linux-gnu/libXcursor.so.1.0.2

7f789a0e8000-7f789a7cb000 r--p 00000000 08:05 4856463 /usr/lib/locale/locale-archive

7f789a7cb000-7f789a7cc000 ---p 00000000 00:00 0

7f789a7cc000-7f789afcc000 rw-p 00000000 00:00 0

7f789afcc000-7f789afe4000 r-xp 00000000 08:05 3801993 /lib/x86_64-linux-gnu/libresolv-2.15.so

7f789afe4000-7f789b1e4000 ---p 00018000 08:05 3801993 /lib/x86_64-linux-gnu/libresolv-2.15.so

7f789b1e4000-7f789b1e5000 r--p 00018000 08:05 3801993 /lib/x86_64-linux-gnu/libresolv-2.15.so

7f789b1e5000-7f789b1e6000 rw-p 00019000 08:05 3801993 /lib/x86_64-linux-gnu/libresolv-2.15.so

7f789b1e6000-7f789b1e8000 rw-p 00000000 00:00 0

7f789b1e8000-7f789b1ee000 r-xp 00000000 08:05 4857537 /usr/lib/x86_64-linux-gnu/libogg.so.0.7.1

7f789b1ee000-7f789b3ed000 ---p 00006000 08:05 4857537 /usr/lib/x86_64-linux-gnu/libogg.so.0.7.1

7f789b3ed000-7f789b3ee000 r--p 00005000 08:05 4857537 /usr/lib/x86_64-linux-gnu/libogg.so.0.7.1

7f789b3ee000-7f789b3ef000 rw-p 00006000 08:05 4857537 /usr/lib/x86_64-linux-gnu/libogg.so.0.7.1

7f789b3ef000-7f789b41a000 r-xp 00000000 08:05 4857695 /usr/lib/x86_64-linux-gnu/libvorbis.so.0.4.5

7f789b41a000-7f789b619000 ---p 0002b000 08:05 4857695 /usr/lib/x86_64-linux-gnu/libvorbis.so.0.4.5

7f789b619000-7f789b61a000 r--p 0002a000 08:05 4857695 /usr/lib/x86_64-linux-gnu/libvorbis.so.0.4.5

7f789b61a000-7f789b61b000 rw-p 0002b000 08:05 4857695 /usr/lib/x86_64-linux-gnu/libvorbis.so.0.4.5

7f789b61b000-7f789b8ce000 r-xp 00000000 08:05 4857697 /usr/lib/x86_64-linux-gnu/libvorbisenc.so.2.0.8

7f789b8ce000-7f789bacd000 ---p 002b3000 08:05 4857697 /usr/lib/x86_64-linux-gnu/libvorbisenc.so.2.0.8

7f789bacd000-7f789bae9000 r--p 002b2000 08:05 4857697 /usr/lib/x86_64-linux-gnu/libvorbisenc.so.2.0.8

7f789bae9000-7f789baea000 rw-p 002ce000 08:05 4857697 /usr/lib/x86_64-linux-gnu/libvorbisenc.so.2.0.8

7f789baea000-7f789bb32000 r-xp 00000000 08:05 4857070 /usr/lib/x86_64-linux-gnu/libFLAC.so.8.2.0

7f789bb32000-7f789bd32000 ---p 00048000 08:05 4857070 /usr/lib/x86_64-linux-gnu/libFLAC.so.8.2.0

7f789bd32000-7f789bd33000 r--p 00048000 08:05 4857070 /usr/lib/x86_64-linux-gnu/libFLAC.so.8.2.0

7f789bd33000-7f789bd34000 rw-p 00049000 08:05 4857070 /usr/lib/x86_64-linux-gnu/libFLAC.so.8.2.0

7f789bd34000-7f789bd4b000 r-xp 00000000 08:05 3804922 /lib/x86_64-linux-gnu/libnsl-2.15.so

7f789bd4b000-7f789bf4a000 ---p 00017000 08:05 3804922 /lib/x86_64-linux-gnu/libnsl-2.15.so

7f789bf4a000-7f789bf4b000 r--p 00016000 08:05 3804922 /lib/x86_64-linux-gnu/libnsl-2.15.so

7f789bf4b000-7f789bf4c000 rw-p 00017000 08:05 3804922 /lib/x86_64-linux-gnu/libnsl-2.15.so

7f789bf4c000-7f789bf4e000 rw-p 00000000 00:00 0

7f789bf4e000-7f789bf53000 r-xp 00000000 08:05 4857138 /usr/lib/x86_64-linux-gnu/libXdmcp.so.6.0.0

7f789bf53000-7f789c152000 ---p 00005000 08:05 4857138 /usr/lib/x86_64-linux-gnu/libXdmcp.so.6.0.0

7f789c152000-7f789c153000 r--p 00004000 08:05 4857138 /usr/lib/x86_64-linux-gnu/libXdmcp.so.6.0.0

7f789c153000-7f789c154000 rw-p 00005000 08:05 4857138 /usr/lib/x86_64-linux-gnu/libXdmcp.so.6.0.0

7f789c154000-7f789c156000 r-xp 00000000 08:05 4857127 /usr/lib/x86_64-linux-gnu/libXau.so.6.0.0

7f789c156000-7f789c355000 ---p 00002000 08:05 4857127 /usr/lib/x86_64-linux-gnu/libXau.so.6.0.0

7f789c355000-7f789c356000 r--p 00001000 08:05 4857127 /usr/lib/x86_64-linux-gnu/libXau.so.6.0.0Aborted (core dumped)

Answer 1

Apparently SDL_FreeSurface() will catch a NULL pointer, so this is not because you failed to check the return value of TTF_RenderText_Solid(), which, according to this API reference, will return NULL on error.

However, what that would mean for SDL_BlitSurface() I don't know, so you should be checking that anyway. I notice in some documentation for BlitSurface that:

If either of the surfaces were in video memory, and the blit returns -2, the video memory was lost, so it should be reloaded with artwork and re-blitted...

Which may have some significance.

WRT to this:

printf("Last thing that is printed\n");
SDL_FreeSurface(surface_text);
printf("Not reaching here...\n", surface_text);

Although a newline may flush the stdout buffer, it is a much better idea to use stderr --fprintf(stderr, "...") -- for this kind of debugging since stderr is unbuffered and the program may actually die after your second printf() is executed but before the stdout buffer is flushed. Deceptive!