mirrors/alsa-lib
1
0
Fork 0
mirror of https://github.com/alsa-project/alsa-lib.git synced 2025-11-06 13:29:59 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix access of freed memory in namehints

Browse source 
Sometimes a hook manipulates the config tree, which makes currently
running iterators point to freed memory. As a workaround, make two
copies, one for the iterators and another for the hooks.

BugLink: https://bugs.launchpad.net/bugs/1008600
Signed-off-by: David Henningsson <david.henningsson@canonical.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
This commit is contained in:
David Henningsson 2013-09-13 13:21:44 -04:00 • committed by Takashi Iwai
parent f21f48a70f
commit 23bf1dce94
1 changed files with 13 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

22
src/control/namehint.c
View file

@ -406,7 +406,7 @@ static const next_devices_t next_devices[] = {
}; };
#endif #endif
static int add_card(snd_config_t *config, struct hint_list *list, int card) static int add_card(snd_config_t *config, snd_config_t *rw_config, struct hint_list *list, int card)
{ {
int err, ok; int err, ok;
snd_config_t *conf, *n; snd_config_t *conf, *n;
@ -449,7 +449,7 @@ static int add_card(snd_config_t *config, struct hint_list *list, int card)
ok = 0; ok = 0;
for (device = 0; err >= 0 && device <= max_device; device++) { for (device = 0; err >= 0 && device <= max_device; device++) {
list->device = device; list->device = device;
err = try_config(config, list, list->siface, str); err = try_config(rw_config, list, list->siface, str);
if (err < 0) if (err < 0)
break; break;
ok++; ok++;
@ -464,7 +464,7 @@ static int add_card(snd_config_t *config, struct hint_list *list, int card)
if (err < 0) { if (err < 0) {
list->card = card; list->card = card;
list->device = -1; list->device = -1;
err = try_config(config, list, list->siface, str); err = try_config(rw_config, list, list->siface, str);
} }
if (err == -ENOMEM) if (err == -ENOMEM)
goto __error; goto __error;
@ -493,7 +493,8 @@ static int get_card_name(struct hint_list *list, int card)
return 0; return 0;
} }
static int add_software_devices(snd_config_t *config, struct hint_list *list) static int add_software_devices(snd_config_t *config, snd_config_t *rw_config,
struct hint_list *list)
{ {
int err; int err;
snd_config_t *conf, *n; snd_config_t *conf, *n;
@ -509,7 +510,7 @@ static int add_software_devices(snd_config_t *config, struct hint_list *list)
continue; continue;
list->card = -1; list->card = -1;
list->device = -1; list->device = -1;
err = try_config(config, list, list->siface, str); err = try_config(rw_config, list, list->siface, str);
if (err == -ENOMEM) if (err == -ENOMEM)
return -ENOMEM; return -ENOMEM;
} }
@ -547,7 +548,7 @@ int snd_device_name_hint(int card, const char *iface, void ***hints)
struct hint_list list; struct hint_list list;
char ehints[24]; char ehints[24];
const char *str; const char *str;
snd_config_t *conf, *local_config = NULL; snd_config_t *conf, *local_config = NULL, *local_config_rw = NULL;
snd_config_update_t *local_config_update = NULL; snd_config_update_t *local_config_update = NULL;
snd_config_iterator_t i, next; snd_config_iterator_t i, next;
int err; int err;
@ -557,6 +558,7 @@ int snd_device_name_hint(int card, const char *iface, void ***hints)
err = snd_config_update_r(&local_config, &local_config_update, NULL); err = snd_config_update_r(&local_config, &local_config_update, NULL);
if (err < 0) if (err < 0)
return err; return err;
err = snd_config_copy(&local_config_rw, local_config);
list.list = NULL; list.list = NULL;
list.count = list.allocated = 0; list.count = list.allocated = 0;
list.siface = iface; list.siface = iface;
@ -586,9 +588,9 @@ int snd_device_name_hint(int card, const char *iface, void ***hints)
if (card >= 0) { if (card >= 0) {
err = get_card_name(&list, card); err = get_card_name(&list, card);
if (err >= 0) if (err >= 0)
err = add_card(local_config, &list, card); err = add_card(local_config, local_config_rw, &list, card);
} else { } else {
add_software_devices(local_config, &list); add_software_devices(local_config, local_config_rw, &list);
err = snd_card_next(&card); err = snd_card_next(&card);
if (err < 0) if (err < 0)
goto __error; goto __error;
@ -596,7 +598,7 @@ int snd_device_name_hint(int card, const char *iface, void ***hints)
err = get_card_name(&list, card); err = get_card_name(&list, card);
if (err < 0) if (err < 0)
goto __error; goto __error;
err = add_card(local_config, &list, card); err = add_card(local_config, local_config_rw, &list, card);
if (err < 0) if (err < 0)
goto __error; goto __error;
err = snd_card_next(&card); err = snd_card_next(&card);
@ -630,6 +632,8 @@ int snd_device_name_hint(int card, const char *iface, void ***hints)
if (list.cardname) if (list.cardname)
free(list.cardname); free(list.cardname);
} }
if (local_config_rw)
snd_config_delete(local_config_rw);
if (local_config) if (local_config)
snd_config_delete(local_config); snd_config_delete(local_config);
if (local_config_update) if (local_config_update)