mirrors/alsa-lib
1
0
Fork 0
mirror of https://github.com/alsa-project/alsa-lib.git synced 2025-11-03 09:01:52 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

conf: Fix invalid free at parse_args()

Browse source 
The previous fix for memory leaks introduced a few regression.
The major one is the assert hit in the error path reaching with NULL
or uninitialized sub object.  Also, in other code paths, it's possible
that an already released sub object gets freed again.

Fix those bugs by initializing the sub object properly and add a NULL
check before calling snd_config_delete().

Fixes: ad5f255b47 ("conf: fix memory leak on the error path in parse_args()")
Reported-and-tested-by: Mark Hills <mark@xwax.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
This commit is contained in:
Takashi Iwai 2021-03-18 17:43:58 +01:00
parent 74422643ee
commit 7bf1dd543b
1 changed files with 5 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

6
src/conf.c
View file

@ -5080,6 +5080,8 @@ static int parse_args(snd_config_t *subs, const char *str, snd_config_t *defs)
const char *new = str;
const char *tmp;
char *val = NULL;
sub = NULL;
err = parse_arg(&new, &varlen, &val);
if (err < 0)
goto _err;
@ -5104,6 +5106,7 @@ static int parse_args(snd_config_t *subs, const char *str, snd_config_t *defs)
err = snd_config_search(subs, var, &sub);
if (err >= 0)
snd_config_delete(sub);
sub = NULL;
err = snd_config_search(def, "type", &typ);
if (err < 0) {
_invalid_type:
@ -5169,7 +5172,8 @@ static int parse_args(snd_config_t *subs, const char *str, snd_config_t *defs)
err = snd_config_add(subs, sub);
if (err < 0) {
_err:
snd_config_delete(sub);
if (sub)
snd_config_delete(sub);
free(val);
return err;
}