mirrors/alsa-lib
1
0
Fork 0
mirror of https://github.com/alsa-project/alsa-lib.git synced 2025-11-03 09:01:52 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

ucm: compound_merge() - fix use after free (and logic)

Browse source 
Signed-off-by: Jaroslav Kysela <perex@perex.cz>
This commit is contained in:
Jaroslav Kysela 2021-06-03 09:00:51 +02:00
parent e213309060
commit 0325f4357d
1 changed files with 5 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

8
src/ucm/ucm_include.c
View file

@ -108,7 +108,7 @@ static int find_position_node(snd_config_t **res, snd_config_t *dst,
return 0; return 0;
} }
static int merge_it(snd_config_t *dst, snd_config_t *n) static int merge_it(snd_config_t *dst, snd_config_t *n, snd_config_t **_dn)
{ {
snd_config_t *dn; snd_config_t *dn;
const char *id; const char *id;
@ -123,6 +123,8 @@ static int merge_it(snd_config_t *dst, snd_config_t *n)
err = snd_config_merge(dn, n, 0); /* merge / append mode */ err = snd_config_merge(dn, n, 0); /* merge / append mode */
if (err < 0) if (err < 0)
snd_config_delete(n); snd_config_delete(n);
else
*_dn = dn;
return err; return err;
} }
@ -198,7 +200,7 @@ static int compound_merge(const char *id,
if (_before) { if (_before) {
err = snd_config_add_before(_before, n); err = snd_config_add_before(_before, n);
if (err == -EEXIST) if (err == -EEXIST)
err = merge_it(dst, n); err = merge_it(dst, n, &n);
if (err < 0) if (err < 0)
return err; return err;
_before = NULL; _before = NULL;
@ -206,7 +208,7 @@ static int compound_merge(const char *id,
} else if (_after) { } else if (_after) {
err = snd_config_add_after(_after, n); err = snd_config_add_after(_after, n);
if (err == -EEXIST) if (err == -EEXIST)
err = merge_it(dst, n); err = merge_it(dst, n, &n);
if (err < 0) if (err < 0)
return err; return err;
_after = n; _after = n;