mirrors/alsa-lib
1
0
Fork 0
mirror of https://github.com/alsa-project/alsa-lib.git synced 2025-11-01 22:58:49 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix corruption after snd_device_name_hint()

Browse source 
snd_device_name_hint() corrupts the config name space after its call.
This results in the error from the suceeding calls of snd_pcm_open()
after snd_device_name_hint().

The bug is in try_config() in namehint.c; it calls snd_config_delete(res)
but res can be two different objects in the function.  One is the object
obtained via snd_config_search_definition(), and another is the one from
snd_config_search_alias_hooks().  The former is the expanded objects,
thus it should be freed.  But, the latter is a reference, and must not be
freed.

This patch adds the check to free or not.

Reported-by: John Lindgren <john.lindgren@tds.net>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
This commit is contained in:
Takashi Iwai 2009-11-03 08:57:10 +01:00
parent 0110d62043
commit e1c7dd2613
1 changed files with 4 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

5
src/control/namehint.c
View file

@ -219,6 +219,7 @@ static int try_config(struct hint_list *list,
const char *str;
int err = 0, level;
long dev = list->device;
int cleanup_res = 0;
list->device_input = -1;
list->device_output = -1;
@ -244,6 +245,7 @@ static int try_config(struct hint_list *list,
snd_lib_error_set_handler(eh);
if (err < 0)
goto __skip_add;
cleanup_res = 1;
err = -EINVAL;
if (snd_config_get_type(res) != SND_CONFIG_TYPE_COMPOUND)
goto __cleanup;
@ -330,6 +332,7 @@ static int try_config(struct hint_list *list,
goto __hint;
snd_config_delete(res);
res = NULL;
cleanup_res = 0;
if (strchr(buf, ':') != NULL)
goto __ok;
/* find, if all parameters have a default, */
@ -379,7 +382,7 @@ static int try_config(struct hint_list *list,
err = hint_list_add(list, buf, buf1);
}
__skip_add:
if (res)
if (res && cleanup_res)
snd_config_delete(res);
if (buf1)
free(buf1);