mirrors/alsa-lib
1
0
Fork 0
mirror of https://github.com/alsa-project/alsa-lib.git synced 2025-11-05 13:30:00 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

ucm: compound_merge() - fix use after free (and logic)

Browse source 
Signed-off-by: Jaroslav Kysela <perex@perex.cz>
This commit is contained in:
Jaroslav Kysela 2021-06-03 09:00:51 +02:00
parent e213309060
commit 0325f4357d
1 changed files with 5 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

8
src/ucm/ucm_include.c
View file

@ -108,7 +108,7 @@ static int find_position_node(snd_config_t **res, snd_config_t *dst,
return 0;
}
static int merge_it(snd_config_t *dst, snd_config_t *n)
static int merge_it(snd_config_t *dst, snd_config_t *n, snd_config_t **_dn)
{
snd_config_t *dn;
const char *id;
@ -123,6 +123,8 @@ static int merge_it(snd_config_t *dst, snd_config_t *n)
err = snd_config_merge(dn, n, 0); /* merge / append mode */
if (err < 0)
snd_config_delete(n);
else
*_dn = dn;
return err;
}
@ -198,7 +200,7 @@ static int compound_merge(const char *id,
if (_before) {
err = snd_config_add_before(_before, n);
if (err == -EEXIST)
err = merge_it(dst, n);
err = merge_it(dst, n, &n);
if (err < 0)
return err;
_before = NULL;
@ -206,7 +208,7 @@ static int compound_merge(const char *id,
} else if (_after) {
err = snd_config_add_after(_after, n);
if (err == -EEXIST)
err = merge_it(dst, n);
err = merge_it(dst, n, &n);
if (err < 0)
return err;
_after = n;