# Possible bug in SDL\_surface.c discovered, line 87, improper malloc

**URL:** <https://discourse.libsdl.org/t/possible-bug-in-sdl-surface-c-discovered-line-87-improper-malloc/12109>\
**Category:** SDL Development\
**Created:** [April 21, 2005, 6:44am UTC](https://discourse.libsdl.org/t/possible-bug-in-sdl-surface-c-discovered-line-87-improper-malloc/12109 "2005-04-21T06:44:57Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Paul\_Lowe](https://discourse.libsdl.org/letter_avatar_proxy/v4/letter/p/848f3c/32.png) [@Paul\_Lowe](https://discourse.libsdl.org/u/Paul_Lowe)\
**Post date:** [April 21, 2005, 6:44am UTC](https://discourse.libsdl.org/t/possible-bug-in-sdl-surface-c-discovered-line-87-improper-malloc/12109/1 "2005-04-21T06:44:57Z")

</div>

Could someone please correct me if I’m wrong, but I believe  
I have found a bug in the SDL 1.2.8 source code:

File: "SDL-1.2.8/src/video/SDL\_surface.c"  
Line: 87

The pointer surface is never initialized, but is  
dereferenced as a “size\_t” argument of malloc.

```
    /* Allocate the surface */

```

/\* BUG BELOW THIS LINE??? \*/  
surface = (SDL\_Surface \*)malloc(sizeof(_surface));  
/_ BUG ABOVE THIS LINE??? \*/

```
    if ( surface == NULL ) {
            SDL_OutOfMemory();
            return(NULL);
    }

```

Thanks,

Paul Lowe  
paul at [tetravista.net](http://tetravista.net)

---

<div class="post-metadata">

**Author:** ![icculus](https://discourse.libsdl.org/user_avatar/discourse.libsdl.org/icculus/32/81_2.png) [@icculus](https://discourse.libsdl.org/u/icculus)\
**Post date:** [April 21, 2005, 7:55am UTC](https://discourse.libsdl.org/t/possible-bug-in-sdl-surface-c-discovered-line-87-improper-malloc/12109/2 "2005-04-21T07:55:43Z")

</div>

> The pointer surface is never initialized, but is  
> dereferenced as a “size\_t” argument of malloc.
> 
> ```
> /* Allocate the surface */
> 
> ```
> 
> /\* BUG BELOW THIS LINE??? \*/  
> surface = (SDL\_Surface \*)malloc(sizeof(_surface));  
> /_ BUG ABOVE THIS LINE??? \*/

Not a dereference in sizeof()…this is naughty C syntax stuff.

For a clearer example:

#include \<stdio.h\>

int main(void)  
{  
int \*x = NULL;  
printf(“%d\n%d\n”, sizeof (\*x), sizeof (5+1));  
return(0);  
}

–ryan.

---

<div class="post-metadata">

**Author:** ![David\_Olofson](https://discourse.libsdl.org/user_avatar/discourse.libsdl.org/david_olofson/32/115_2.png) [@David\_Olofson](https://discourse.libsdl.org/u/David_Olofson)\
**Post date:** [April 21, 2005, 8:27am UTC](https://discourse.libsdl.org/t/possible-bug-in-sdl-surface-c-discovered-line-87-improper-malloc/12109/3 "2005-04-21T08:27:24Z")

</div>

> Could someone please correct me if I’m wrong, but I believe  
> I have found a bug in the SDL 1.2.8 source code:  
> […]  
> surface = (SDL\_Surface \*)malloc(sizeof(\*surface));  
> […]

This just determines the size of the target type of the surface  
pointer at compile time (C is a statically typed language! :-), so  
the value of the pointer at run time is totally irrelevant.

//David Olofson - Programmer, Composer, Open Source Advocate

.- Audiality -----------------------------------------------.  
| Free/Open Source audio engine for games and multimedia. |  
| MIDI, modular synthesis, real time effects, scripting,… |  
`-----------------------------------\> [http://audiality.org](http://audiality.org) -’  
— [http://olofson.net](http://olofson.net) — [http://www.reologica.se](http://www.reologica.se) —On Thursday 21 April 2005 08.44, Paul Lowe wrote: