diff options
| author | Felipe Sateler <fsateler@debian.org> | 2015-09-11 20:15:21 -0300 |
|---|---|---|
| committer | Tanu Kaskinen <tanuk@iki.fi> | 2015-09-12 16:09:24 +0300 |
| commit | 2a1d876b1c217a8514c5ac0b3b9897a707f28b01 (patch) | |
| tree | d635e1810052934990f9925e8e4cc7a028be3ae0 | |
| parent | b42575e1832c5af4ce5cc8512361e4c33b04a71d (diff) | |
| download | pulseaudio-2a1d876b1c217a8514c5ac0b3b9897a707f28b01.tar.gz | |
sink, source: Do not dereference freed memory when freeing the next events
Coverity IDs: 1138197, 1138196
| -rw-r--r-- | src/pulsecore/sink.c | 3 | ||||
| -rw-r--r-- | src/pulsecore/source.c | 3 |
2 files changed, 4 insertions, 2 deletions
diff --git a/src/pulsecore/sink.c b/src/pulsecore/sink.c index c2bf0e448..9ddb5272a 100644 --- a/src/pulsecore/sink.c +++ b/src/pulsecore/sink.c @@ -3543,6 +3543,7 @@ static void pa_sink_volume_change_free(pa_sink_volume_change *c) { void pa_sink_volume_change_push(pa_sink *s) { pa_sink_volume_change *c = NULL; pa_sink_volume_change *nc = NULL; + pa_sink_volume_change *pc = NULL; uint32_t safety_margin = s->thread_info.volume_change_safety_margin; const char *direction = NULL; @@ -3600,7 +3601,7 @@ void pa_sink_volume_change_push(pa_sink *s) { pa_log_debug("Volume going %s to %d at %llu", direction, pa_cvolume_avg(&nc->hw_volume), (long long unsigned) nc->at); /* We can ignore volume events that came earlier but should happen later than this. */ - PA_LLIST_FOREACH(c, nc->next) { + PA_LLIST_FOREACH_SAFE(c, pc, nc->next) { pa_log_debug("Volume change to %d at %llu was dropped", pa_cvolume_avg(&c->hw_volume), (long long unsigned) c->at); pa_sink_volume_change_free(c); } diff --git a/src/pulsecore/source.c b/src/pulsecore/source.c index 2dd7a2802..b553a2d77 100644 --- a/src/pulsecore/source.c +++ b/src/pulsecore/source.c @@ -2654,6 +2654,7 @@ static void pa_source_volume_change_free(pa_source_volume_change *c) { void pa_source_volume_change_push(pa_source *s) { pa_source_volume_change *c = NULL; pa_source_volume_change *nc = NULL; + pa_source_volume_change *pc = NULL; uint32_t safety_margin = s->thread_info.volume_change_safety_margin; const char *direction = NULL; @@ -2711,7 +2712,7 @@ void pa_source_volume_change_push(pa_source *s) { pa_log_debug("Volume going %s to %d at %llu", direction, pa_cvolume_avg(&nc->hw_volume), (long long unsigned) nc->at); /* We can ignore volume events that came earlier but should happen later than this. */ - PA_LLIST_FOREACH(c, nc->next) { + PA_LLIST_FOREACH_SAFE(c, pc, nc->next) { pa_log_debug("Volume change to %d at %llu was dropped", pa_cvolume_avg(&c->hw_volume), (long long unsigned) c->at); pa_source_volume_change_free(c); } |