Fixed bug 1802 - NULL pointer dereference in SDL_AllocRW() if out of memory.

Philipp Wiesemann

There is a NULL pointer dereference in SDL_AllocRW() if the system is out of memory. The "type" field is always written. This may be fixed with an early return.

Or an else{} or not writing the field and using slower SDL_calloc().

This fault was recently introduced (http://hg.libsdl.org/SDL/rev/681820ca0e78).
Fixed bug 1804 - Memory leak issue in src/video/x11/SDL_x11mouse.c

Nitz

In SDL_x11mouse.c file there is function named
static Cursor
X11_CreatePixmapCursor(SDL_Surface * surface, int hot_x, int hot_y)
{
  // Some code

  data_bits = SDL_calloc(1, surface->h * width_bytes);
  mask_bits = SDL_calloc(1, surface->h * width_bytes);
  if (!data_bits || !mask_bits) {
     SDL_OutOfMemory();
     return None;
  }

 // Some code

}

Here is the problem in if statement,
suppose if !data_bits is false and !mask_bits is true then,
data_bits will go out of scope and leaks the memory it points to.

Solution is that data_bits and mask_bits should be checked separately, not by using OR operator.
Fixed bug 1805 - Memory Leak issue in src/video/x11/edid-parse.c file

Nitz

In Function,

MonitorInfo *
decode_edid (const uchar *edid)

In this function "info" is going out of scope and leaks the storage it points to, if the first if condition get true:
if (!decode_header (edid))
        return NULL;

So while returning from this if statement there should be free for "info" pointer.