]> code.delx.au - pulseaudio/commitdiff
core: Use after free in pa_sink_input_new_data_set_formats() and pa_source_output_new...
authorPeter Meerwald <p.meerwald@bct-electronic.com>
Mon, 16 Dec 2013 23:27:35 +0000 (00:27 +0100)
committerPeter Meerwald <p.meerwald@bct-electronic.com>
Fri, 20 Dec 2013 11:55:17 +0000 (12:55 +0100)
intention is to free old data_req->formats before assigning
new formats, discovered by coverity

Signed-off-by: Peter Meerwald <pmeerw@pmeerw.net>
src/pulsecore/sink-input.c
src/pulsecore/source-output.c

index b002467a602de3e08967b49eb3864aef41fd83c5..8052724fa5a8012a2dbd86a3ee97908a3b8f3598 100644 (file)
@@ -218,7 +218,7 @@ bool pa_sink_input_new_data_set_formats(pa_sink_input_new_data *data, pa_idxset
     pa_assert(formats);
 
     if (data->req_formats)
-        pa_idxset_free(formats, (pa_free_cb_t) pa_format_info_free);
+        pa_idxset_free(data->req_formats, (pa_free_cb_t) pa_format_info_free);
 
     data->req_formats = formats;
 
index 7b780022ad46025f24c4d114282944a590c726dc..834a4189d3fc82f0e9d35965824f6cbdaad78f61 100644 (file)
@@ -161,7 +161,7 @@ bool pa_source_output_new_data_set_formats(pa_source_output_new_data *data, pa_i
     pa_assert(formats);
 
     if (data->req_formats)
-        pa_idxset_free(formats, (pa_free_cb_t) pa_format_info_free);
+        pa_idxset_free(data->req_formats, (pa_free_cb_t) pa_format_info_free);
 
     data->req_formats = formats;