mirrors/alsa-lib
1
0
Fork 0
mirror of https://github.com/alsa-project/alsa-lib.git synced 2025-11-06 13:29:59 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

namehint: Fix invalid list access in snd_device_name_hint()

Browse source 
snd_device_name_hint() tries to free the allocated list at the error
path via snd_device_name_free_hint().  But snd_device_name_free_hint()
expects a list terminated by NULL while snd_device_name_hint() doesn't
add it.  Adding it may again result in an error and thus isn't
guaranteed to work.  Hence we can't add NULL at the error path.

Instead, now the code always allocates one entry more, and zero-clears
the newly allocated beforehand to guarantee the NULL termination.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
This commit is contained in:
Takashi Iwai 2015-04-30 12:26:43 +02:00
parent ba6fa7b5a6
commit bf98b4e316
1 changed files with 10 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

21
src/control/namehint.c
View file

@ -52,10 +52,11 @@ static int hint_list_add(struct hint_list *list,
{
char *x;
if (list->count == list->allocated) {
if (list->count + 1 >= list->allocated) {
char **n = realloc(list->list, (list->allocated + 10) * sizeof(char *));
if (n == NULL)
return -ENOMEM;
memset(n + list->allocated, 0, 10 * sizeof(*n));
list->allocated += 10;
list->list = n;
}
@ -620,18 +621,16 @@ int snd_device_name_hint(int card, const char *iface, void ***hints)
}
err = 0;
__error:
if (err < 0) {
/* add an empty entry if nothing has been added yet; the caller
* expects non-NULL return
*/
if (!err && !list.list)
err = hint_list_add(&list, NULL, NULL);
if (err < 0)
snd_device_name_free_hint((void **)list.list);
if (list.cardname)
free(list.cardname);
} else {
err = hint_list_add(&list, NULL, NULL);
if (err < 0)
goto __error;
else
*hints = (void **)list.list;
if (list.cardname)
free(list.cardname);
}
free(list.cardname);
if (local_config_rw)
snd_config_delete(local_config_rw);
if (local_config)