The Fuse emulator crashes on SDL_WM_SetCaption when the window is resized

[bertogg]

Hi,

The Fuse ZX Spectrum emulator is crashing with the latest versions of sdl12-compat. The stack traces are different and often point to the seemingly innocent SDL20_free(WindowTitle) call in SDL_WM_SetCaption(), so this smells a lot like heap corruption.

I bisected the problem and the regression started with commit 0ea5b38.

I'm not too sure about what's going on here but it looks like before that patch VideoTexture20 was always being recreated on SetVideoModeImpl() but now it's reused.

If I force its destruction the problem goes away:

--- a/src/SDL12_compat.c
+++ b/src/SDL12_compat.c
@@ -6812,6 +6812,9 @@ SetVideoModeImpl(int width, int height, int bpp, Uint32 flags12)
             return EndVidModeCreate();
         }
 
+        SDL20_DestroyTexture(VideoTexture20);
+        VideoTexture20 = NULL;
+
         if (!VideoTexture20) {
             SDL20_SetHint(SDL_HINT_RENDER_SCALE_QUALITY, WantScaleMethodNearest ? "0" : "1");
             VideoTexture20 = SDL20_CreateTexture(VideoRenderer20, rinfo.texture_formats[0], SDL_TEXTUREACCESS_STREAMING, width, height);

Fuse doesn't seem to crash with the default configuration (which opens a window with a very small resolution) but crashes immediately when I change the window size.

So I'm guessing that when Fuse changes the resolution the old texture is being reused but there's a buffer that is now too small, does that make sense?

[slouken]

@icculus, can you look at this?

[bertogg]

Here's a simple reproducer:

#include <SDL.h>

void main(void)
{
    SDL_Surface *screen;
    SDL_Init(SDL_INIT_VIDEO);

    screen = SDL_SetVideoMode(320, 240, 8, SDL_SWSURFACE);
    SDL_FillRect(screen, NULL, 0);
    SDL_Flip(screen);
    SDL_WM_SetCaption("title1", "icon1");

    screen = SDL_SetVideoMode(640, 480, 8, SDL_SWSURFACE);
    SDL_FillRect(screen, NULL, 0);
    SDL_Flip(screen);
    SDL_WM_SetCaption("title2", "icon2");

    SDL_Quit();
}