[pulseaudio-commits] 2 commits - git-version-gen src/pulsecore

[David Henningsson]

 git-version-gen         |    5 ++++-
 src/pulsecore/pstream.c |   11 ++++++++++-
 2 files changed, 14 insertions(+), 2 deletions(-)

New commits:
commit c25b06577c2cc251c541732f245117c913206916
Author: Ross Burton <ross at burtonini.com>
Date:   Tue Oct 20 16:55:23 2015 +0200

    git-version-gen: Avoid further processing when tarball-version is present
    
    In case a tarball-version file is present, use that and quit.
    
    Otherwise git will continue looking for directories, potentially
    finding .git directories which are dirty and mark the version as such.
    
    BugLink: https://bugs.freedesktop.org/show_bug.cgi?id=90936

diff --git a/git-version-gen b/git-version-gen
index 7546884..079b93e 100755
--- a/git-version-gen
+++ b/git-version-gen
@@ -84,7 +84,10 @@ then
     v=`cat $tarball_version_file` || exit 1
     case $v in
 	*$nl*) v= ;; # reject multi-line output
-	[0-9]*) ;;
+	[0-9]*)
+		echo "$v" | tr -d '\012'
+		exit 0
+		;;
 	*) v= ;;
     esac
     test -z "$v" \

commit f277f2c5094fb32c5d879923960eb807b3b1c535
Author: David Henningsson <david.henningsson at canonical.com>
Date:   Fri Oct 16 22:12:32 2015 +0200

    pstream: Fix use-after-free in srb_callback
    
    We need to guard the pstream with an extra ref to ensure
    it is not destroyed at the time we check whether or not the
    srbchannel is destroyed.
    
    Reported-by: Takashi Iwai <tiwai at suse.de>
    BugLink: http://bugzilla.opensuse.org/show_bug.cgi?id=950487
    Signed-off-by: David Henningsson <david.henningsson at canonical.com>

diff --git a/src/pulsecore/pstream.c b/src/pulsecore/pstream.c
index 8c14fbb..98a8382 100644
--- a/src/pulsecore/pstream.c
+++ b/src/pulsecore/pstream.c
@@ -216,14 +216,23 @@ fail:
 }
 
 static bool srb_callback(pa_srbchannel *srb, void *userdata) {
+    bool b;
     pa_pstream *p = userdata;
 
     pa_assert(p);
     pa_assert(PA_REFCNT_VALUE(p) > 0);
     pa_assert(p->srb == srb);
 
+    pa_pstream_ref(p);
+
     do_pstream_read_write(p);
-    return p->srb != NULL;
+
+    /* If either pstream or the srb is going away, return false.
+       We need to check this before p is destroyed. */
+    b = (PA_REFCNT_VALUE(p) > 1) && (p->srb == srb);
+    pa_pstream_unref(p);
+
+    return b;
 }
 
 static void io_callback(pa_iochannel*io, void *userdata) {