core: Fix uninit pointer read in protocol-native

[pulseaudio] / src / pulse / scache.c

diff --git a/src/pulse/scache.c b/src/pulse/scache.c
index 77f60d72c4fdbaa8588d39e34a30aa3a2904ce31..6a26ce56584f936dd1d2272e5eeb25a5c0235530 100644 (file)
--- a/src/pulse/scache.c
+++ b/src/pulse/scache.c
@@ -25,16 +25,15 @@
 
 #include <stdlib.h>
 #include <stdio.h>
-#include <string.h>
 
 #include <pulse/utf8.h>
+#include <pulse/fork-detect.h>
 
 #include <pulsecore/pstream-util.h>
 #include <pulsecore/macro.h>
 #include <pulsecore/proplist-util.h>
 
 #include "internal.h"
-
 #include "scache.h"
 
 int pa_stream_connect_upload(pa_stream *s, size_t length) {
@@ -45,9 +44,11 @@ int pa_stream_connect_upload(pa_stream *s, size_t length) {
     pa_assert(s);
     pa_assert(PA_REFCNT_VALUE(s) >= 1);
 
+    PA_CHECK_VALIDITY(s->context, !pa_detect_fork(), PA_ERR_FORKED);
     PA_CHECK_VALIDITY(s->context, s->state == PA_STREAM_UNCONNECTED, PA_ERR_BADSTATE);
     PA_CHECK_VALIDITY(s->context, length > 0, PA_ERR_INVALID);
     PA_CHECK_VALIDITY(s->context, length == (size_t) (uint32_t) length, PA_ERR_INVALID);
+    PA_CHECK_VALIDITY(s->context, s->context->state == PA_CONTEXT_READY, PA_ERR_BADSTATE);
 
     if (!(name = pa_proplist_gets(s->proplist, PA_PROP_EVENT_ID)))
         name = pa_proplist_gets(s->proplist, PA_PROP_MEDIA_NAME);
@@ -85,6 +86,7 @@ int pa_stream_finish_upload(pa_stream *s) {
     pa_assert(s);
     pa_assert(PA_REFCNT_VALUE(s) >= 1);
 
+    PA_CHECK_VALIDITY(s->context, !pa_detect_fork(), PA_ERR_FORKED);
     PA_CHECK_VALIDITY(s->context, s->channel_valid, PA_ERR_BADSTATE);
     PA_CHECK_VALIDITY(s->context, s->context->state == PA_CONTEXT_READY, PA_ERR_BADSTATE);
 
@@ -112,7 +114,7 @@ static void play_sample_ack_callback(pa_pdispatch *pd, uint32_t command, uint32_
         goto finish;
 
     if (command != PA_COMMAND_REPLY) {
-        if (pa_context_handle_error(o->context, command, t, FALSE) < 0)
+        if (pa_context_handle_error(o->context, command, t, false) < 0)
             goto finish;
 
         success = 0;
@@ -145,7 +147,7 @@ static void play_sample_with_proplist_ack_callback(pa_pdispatch *pd, uint32_t co
         goto finish;
 
     if (command != PA_COMMAND_REPLY) {
-        if (pa_context_handle_error(o->context, command, t, FALSE) < 0)
+        if (pa_context_handle_error(o->context, command, t, false) < 0)
             goto finish;
 
         idx = PA_INVALID_INDEX;
@@ -165,7 +167,6 @@ finish:
     pa_operation_unref(o);
 }
 
-
 pa_operation *pa_context_play_sample(pa_context *c, const char *name, const char *dev, pa_volume_t volume, pa_context_success_cb_t cb, void *userdata) {
     pa_operation *o;
     pa_tagstruct *t;
@@ -174,6 +175,7 @@ pa_operation *pa_context_play_sample(pa_context *c, const char *name, const char
     pa_assert(c);
     pa_assert(PA_REFCNT_VALUE(c) >= 1);
 
+    PA_CHECK_VALIDITY_RETURN_NULL(c, !pa_detect_fork(), PA_ERR_FORKED);
     PA_CHECK_VALIDITY_RETURN_NULL(c, c->state == PA_CONTEXT_READY, PA_ERR_BADSTATE);
     PA_CHECK_VALIDITY_RETURN_NULL(c, name && *name, PA_ERR_INVALID);
     PA_CHECK_VALIDITY_RETURN_NULL(c, !dev || *dev, PA_ERR_INVALID);
@@ -187,7 +189,7 @@ pa_operation *pa_context_play_sample(pa_context *c, const char *name, const char
     pa_tagstruct_putu32(t, PA_INVALID_INDEX);
     pa_tagstruct_puts(t, dev);
 
-    if (volume == (pa_volume_t) -1 && c->version < 15)
+    if (!PA_VOLUME_IS_VALID(volume) && c->version < 15)
         volume = PA_VOLUME_NORM;
 
     pa_tagstruct_putu32(t, volume);
@@ -213,10 +215,10 @@ pa_operation *pa_context_play_sample_with_proplist(pa_context *c, const char *na
     pa_assert(c);
     pa_assert(PA_REFCNT_VALUE(c) >= 1);
 
+    PA_CHECK_VALIDITY_RETURN_NULL(c, !pa_detect_fork(), PA_ERR_FORKED);
     PA_CHECK_VALIDITY_RETURN_NULL(c, c->state == PA_CONTEXT_READY, PA_ERR_BADSTATE);
     PA_CHECK_VALIDITY_RETURN_NULL(c, name && *name, PA_ERR_INVALID);
     PA_CHECK_VALIDITY_RETURN_NULL(c, !dev || *dev, PA_ERR_INVALID);
-    PA_CHECK_VALIDITY_RETURN_NULL(c, p, PA_ERR_INVALID);
     PA_CHECK_VALIDITY_RETURN_NULL(c, c->version >= 13, PA_ERR_NOTSUPPORTED);
 
     o = pa_operation_new(c, NULL, (pa_operation_cb_t) cb, userdata);
@@ -228,12 +230,19 @@ pa_operation *pa_context_play_sample_with_proplist(pa_context *c, const char *na
     pa_tagstruct_putu32(t, PA_INVALID_INDEX);
     pa_tagstruct_puts(t, dev);
 
-    if (volume == (pa_volume_t) -1 && c->version < 15)
+    if (!PA_VOLUME_IS_VALID(volume) && c->version < 15)
         volume = PA_VOLUME_NORM;
 
     pa_tagstruct_putu32(t, volume);
     pa_tagstruct_puts(t, name);
-    pa_tagstruct_put_proplist(t, p);
+
+    if (p)
+        pa_tagstruct_put_proplist(t, p);
+    else {
+        p = pa_proplist_new();
+        pa_tagstruct_put_proplist(t, p);
+        pa_proplist_free(p);
+    }
 
     pa_pstream_send_tagstruct(c->pstream, t);
     pa_pdispatch_register_reply(c->pdispatch, tag, DEFAULT_TIMEOUT, play_sample_with_proplist_ack_callback, pa_operation_ref(o), (pa_free_cb_t) pa_operation_unref);
@@ -249,6 +258,7 @@ pa_operation* pa_context_remove_sample(pa_context *c, const char *name, pa_conte
     pa_assert(c);
     pa_assert(PA_REFCNT_VALUE(c) >= 1);
 
+    PA_CHECK_VALIDITY_RETURN_NULL(c, !pa_detect_fork(), PA_ERR_FORKED);
     PA_CHECK_VALIDITY_RETURN_NULL(c, c->state == PA_CONTEXT_READY, PA_ERR_BADSTATE);
     PA_CHECK_VALIDITY_RETURN_NULL(c, name && *name, PA_ERR_INVALID);