#1152147 freerdp3-sdl: credentials dialog leaks tens of MB per redraw, please backport upstream fix cf36d437b0

Package:
freerdp3-sdl
Source:
freerdp3-sdl
Description:
RDP client for Windows Terminal Services (SDL client)
Submitter:
Oulad Moussa Mustapha
Date:
2026-10-26 08:13:09 UTC
Severity:
normal
Tags:
#1152147#5
Date:
2026-10-26 08:12:10 UTC
From:
To:
Version: freerdp3-sdl 3.15.0+dfsg-2.1+deb13u3 (trixie), libsdl3 3.2.10, libsdl3-ttf 3.2.2.

Description

In 3.15.0, `SdlWidget::render_text()` in `client/SDL/SDL3/dialogs/sdl_widget.cpp` (lines 100-101) creates a text
engine with `TTF_CreateRendererTextEngine()` but frees it with `TTF_DestroySurfaceTextEngine()`. These are two
different engine types, so the renderer engine and its glyph atlas texture are never freed. `render_text()` runs for
every widget on every redraw of the NLA credentials dialog, so the memory grows with each key press and mouse move.

Impact

On our diskless thin clients with limited RAM, the machine freezes after a few characters are typed in the credentials
dialog. We measured the following with a software renderer (`SDL_RENDER_DRIVER=software`):

- RSS is 499 MB at start, then grows by about 154 MB per key press and 36 MB per mouse move.
- A held key with auto-repeat adds about 3.9 GB in 2 s.

Upstream status

Upstream fixed this in the 3.16.0 release:

- 34232d0972 "[client,sdl] refactor sdl dialogs" (2025-05-06) moved the engine into a `SdlWidget` member that is
  created once per widget.
- cf36d437b0 "[client,sdl] fix leak with SDL_ttf usage" (2025-05-09) changed that member's deleter to
  `TTF_DestroyRendererTextEngine`.

cf36d437b0 does not apply to 3.15.0 on its own because it relies on that refactoring. The minimal equivalent for 3.15.0
is the same one-line deleter fix, applied in `render_text()`:

```diff
--- a/client/SDL/SDL3/dialogs/sdl_widget.cpp
+++ b/client/SDL/SDL3/dialogs/sdl_widget.cpp
@@ -97,8 +97,8 @@
                return nullptr;
        }

-       std::unique_ptr<TTF_TextEngine, decltype(&TTF_DestroySurfaceTextEngine)> engine(
-           TTF_CreateRendererTextEngine(renderer), TTF_DestroySurfaceTextEngine);
+       std::unique_ptr<TTF_TextEngine, decltype(&TTF_DestroyRendererTextEngine)> engine(
+           TTF_CreateRendererTextEngine(renderer), TTF_DestroyRendererTextEngine);
        if (!engine)
        {
                widget_log_error(false, "TTF_CreateRendererTextEngine");
```

Testing

With this patch applied to 3.15.0, RSS stayed at 62 MB at start and did not grow with 12 key
presses, 6 mouse moves or a 3 s held key. A standalone SDL3/SDL3_ttf test program that repeats these calls each frame
shows the same behaviour: RSS goes from 121 to 607 MB over 120 redraws with `TTF_DestroySurfaceTextEngine`, and stays
at about 126 MB with `TTF_DestroyRendererTextEngine`.

Could this go into a trixie point release (or a deb13uN security/stable update)?

Upstream issue for a remaining minor case: https://github.com/FreeRDP/FreeRDP/issues/13858