From aa3aa6bb059932503826dd2856aff6be4ef63ac9 Mon Sep 17 00:00:00 2001
From: Jonas Holmberg <jonashg@axis.com>
Date: Fri, 10 Jun 2022 11:34:49 +0200
Subject: [PATCH] stream: Fix memory leak

Cleanup controls instead of inserting new elements with id 0 into the
controls list every time there is an unsupported or invalid PropInfo in
an info_changed node event.
---
 src/pipewire/stream.c | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/src/pipewire/stream.c b/src/pipewire/stream.c
index 58dc80ab7..ef4c4a1ed 100644
--- a/src/pipewire/stream.c
+++ b/src/pipewire/stream.c
@@ -1182,8 +1182,6 @@ static int node_event_param(void *object, int seq,
 			return -EINVAL;
 		}
 
-		spa_list_append(&stream->controls, &c->link);
-
 		pod = spa_pod_get_values(type, &n_vals, &choice);
 
 		c->type = SPA_POD_TYPE(pod);
@@ -1204,22 +1202,28 @@ static int node_event_param(void *object, int seq,
 			vals[0] = SPA_POD_VALUE(struct spa_pod_bool, pod);
 			n_vals = 3;
 		}
-		else
+		else {
+			free(c);
 			return -ENOTSUP;
+		}
 
 		c->container = container != SPA_ID_INVALID ? container : c->type;
 
 		switch (choice) {
 		case SPA_CHOICE_None:
-			if (n_vals < 1)
+			if (n_vals < 1) {
+				free(c);
 				return -EINVAL;
+			}
 			c->control.n_values = 1;
 			c->control.max_values = 1;
 			c->control.values[0] = c->control.def = c->control.min = c->control.max = vals[0];
 			break;
 		case SPA_CHOICE_Range:
-			if (n_vals < 3)
+			if (n_vals < 3) {
+				free(c);
 				return -EINVAL;
+			}
 			c->control.n_values = 1;
 			c->control.max_values = 1;
 			c->control.values[0] = vals[0];
@@ -1228,10 +1232,12 @@ static int node_event_param(void *object, int seq,
 			c->control.max = vals[2];
 			break;
 		default:
+			free(c);
 			return -ENOTSUP;
 		}
 
 		c->id = iid;
+		spa_list_append(&stream->controls, &c->link);
 		pw_log_debug("%p: add control %d (%s) container:%d (def:%f min:%f max:%f)",
 				stream, c->id, c->control.name, c->container,
 				c->control.def, c->control.min, c->control.max);