[Tuxmath-devel] tuxmath-2.0.1 crashes sometimes at SDL_FreeSurface()

[hasufell <has...@ge...>]

A gentoo user has reported the following problem:
https://bugs.gentoo.org/show_bug.cgi?id=508866


> TuxMath crashes sometimes while playing.
> At function powerup_add_comet() executing the line
> if(powerup_comet->comet.formula_surf) SDL_FreeSurface(powerup_comet->comet.formula_surf);
> malloc_printerr() tries to report an error: "*** Error in tuxmath: munmap_chunk(): invalid pointer:"


backtrace:
#0 0x00007fec12c3b535 in __GI_raise (sig=sig@entry=6) at
../nptl/sysdeps/unix/sysv/linux/raise.c:56
56 return INLINE_SYSCALL (tgkill, 3, pid, selftid, sig);
(gdb) bt
#0 0x00007fec12c3b535 in __GI_raise (sig=sig@entry=6) at
../nptl/sysdeps/unix/sysv/linux/raise.c:56
0000001 0x00007fec12c3c9b8 in __GI_abort () at abort.c:90
0000002 0x00007fec12c7bbfb in __libc_message (do_abort=do_abort@entry=2,
    fmt=fmt@entry=0x7fec12d70de8 "*** Error in `%s': %s: 0x%s ***\n") at
../sysdeps/unix/sysv/linux/libc_fatal.c:196
0000003 0x00007fec12c818d6 in malloc_printerr (action=3,
str=0x7fec12d70ed0 "munmap_chunk(): invalid pointer", ptr=<optimized out>)
    at malloc.c:4902
0000004 0x000000000040e747 in powerup_add_comet () at game.c:4185
0000005 powerup_add_comet () at game.c:4146
0000006 0x0000000000411650 in add_comet () at game.c:3166
0000007 game_handle_comets () at game.c:1594
0000008 0x0000000000411db3 in game () at game.c:373
0000009 0x0000000000421860 in start_campaign () at campaign.c:80
0000010 0x0000000000409914 in handle_activity (act=<optimized out>,
param=0) at menu.c:137
0000011 0x00007fec12fbaae7 in T4K_RunMenu (index=index@entry=0,
return_choice=return_choice@entry=false,
    draw_background=0x406a20 <DrawTitleScreen>, handle_event=0x408c80
<HandleTitleScreenEvents>,
    handle_animations=0x406ff0 <HandleTitleScreenAnimations>,
handle_activity=handle_activity@entry=0x409760 <handle_activity>)
    at t4k_menu.c:933
0000012 0x0000000000408d34 in run_menu (which=which@entry=MENU_MAIN,
return_choice=return_choice@entry=false) at menu.c:111
0000013 0x0000000000409fe9 in RunMainMenu () at menu.c:755
0000014 0x00000000004074dc in TitleScreen () at titlescreen.c:306
0000015 0x0000000000404fde in main (argc=<optimized out>,
argv=<optimized out>) at tuxmath.c:41