From: Peter Meerwald
Date: Mon, 16 Dec 2013 23:27:35 +0000 (+0100)
Subject: core: Use after free in pa_sink_input_new_data_set_formats() and pa_source_output_new...
X-Git-Url: https://code.delx.au/pulseaudio/commitdiff_plain/e8ea0b8a795b40a58af61c713bf7fc30199847d4
core: Use after free in pa_sink_input_new_data_set_formats() and pa_source_output_new_data_set_formats()
intention is to free old data_req->formats before assigning
new formats, discovered by coverity
Signed-off-by: Peter Meerwald
---
diff --git a/src/pulsecore/sink-input.c b/src/pulsecore/sink-input.c
index b002467a..8052724f 100644
--- a/src/pulsecore/sink-input.c
+++ b/src/pulsecore/sink-input.c
@@ -218,7 +218,7 @@ bool pa_sink_input_new_data_set_formats(pa_sink_input_new_data *data, pa_idxset
pa_assert(formats);
if (data->req_formats)
- pa_idxset_free(formats, (pa_free_cb_t) pa_format_info_free);
+ pa_idxset_free(data->req_formats, (pa_free_cb_t) pa_format_info_free);
data->req_formats = formats;
diff --git a/src/pulsecore/source-output.c b/src/pulsecore/source-output.c
index 7b780022..834a4189 100644
--- a/src/pulsecore/source-output.c
+++ b/src/pulsecore/source-output.c
@@ -161,7 +161,7 @@ bool pa_source_output_new_data_set_formats(pa_source_output_new_data *data, pa_i
pa_assert(formats);
if (data->req_formats)
- pa_idxset_free(formats, (pa_free_cb_t) pa_format_info_free);
+ pa_idxset_free(data->req_formats, (pa_free_cb_t) pa_format_info_free);
data->req_formats = formats;