[pulseaudio-commits] 2 commits - src/pulse src/pulsecore

[Tanu Kaskinen]

 src/pulse/util.c       |    9 +++++++--
 src/pulsecore/sink.c   |    3 ++-
 src/pulsecore/source.c |    3 ++-
 3 files changed, 11 insertions(+), 4 deletions(-)

New commits:
commit 2a1d876b1c217a8514c5ac0b3b9897a707f28b01
Author: Felipe Sateler <fsateler at debian.org>
Date:   Fri Sep 11 20:15:21 2015 -0300

    sink, source: Do not dereference freed memory when freeing the next events
    
    Coverity IDs: 1138197, 1138196

diff --git a/src/pulsecore/sink.c b/src/pulsecore/sink.c
index c2bf0e4..9ddb527 100644
--- a/src/pulsecore/sink.c
+++ b/src/pulsecore/sink.c
@@ -3543,6 +3543,7 @@ static void pa_sink_volume_change_free(pa_sink_volume_change *c) {
 void pa_sink_volume_change_push(pa_sink *s) {
     pa_sink_volume_change *c = NULL;
     pa_sink_volume_change *nc = NULL;
+    pa_sink_volume_change *pc = NULL;
     uint32_t safety_margin = s->thread_info.volume_change_safety_margin;
 
     const char *direction = NULL;
@@ -3600,7 +3601,7 @@ void pa_sink_volume_change_push(pa_sink *s) {
     pa_log_debug("Volume going %s to %d at %llu", direction, pa_cvolume_avg(&nc->hw_volume), (long long unsigned) nc->at);
 
     /* We can ignore volume events that came earlier but should happen later than this. */
-    PA_LLIST_FOREACH(c, nc->next) {
+    PA_LLIST_FOREACH_SAFE(c, pc, nc->next) {
         pa_log_debug("Volume change to %d at %llu was dropped", pa_cvolume_avg(&c->hw_volume), (long long unsigned) c->at);
         pa_sink_volume_change_free(c);
     }
diff --git a/src/pulsecore/source.c b/src/pulsecore/source.c
index 2dd7a28..b553a2d 100644
--- a/src/pulsecore/source.c
+++ b/src/pulsecore/source.c
@@ -2654,6 +2654,7 @@ static void pa_source_volume_change_free(pa_source_volume_change *c) {
 void pa_source_volume_change_push(pa_source *s) {
     pa_source_volume_change *c = NULL;
     pa_source_volume_change *nc = NULL;
+    pa_source_volume_change *pc = NULL;
     uint32_t safety_margin = s->thread_info.volume_change_safety_margin;
 
     const char *direction = NULL;
@@ -2711,7 +2712,7 @@ void pa_source_volume_change_push(pa_source *s) {
     pa_log_debug("Volume going %s to %d at %llu", direction, pa_cvolume_avg(&nc->hw_volume), (long long unsigned) nc->at);
 
     /* We can ignore volume events that came earlier but should happen later than this. */
-    PA_LLIST_FOREACH(c, nc->next) {
+    PA_LLIST_FOREACH_SAFE(c, pc, nc->next) {
         pa_log_debug("Volume change to %d at %llu was dropped", pa_cvolume_avg(&c->hw_volume), (long long unsigned) c->at);
         pa_source_volume_change_free(c);
     }

commit b42575e1832c5af4ce5cc8512361e4c33b04a71d
Author: Felipe Sateler <fsateler at debian.org>
Date:   Fri Sep 11 20:15:20 2015 -0300

    util: pa_get_fqdn: always free addrinfo
    
    Also fix the return error code check of getaddrinfo call
    
    Coverity ID: 1323587

diff --git a/src/pulse/util.c b/src/pulse/util.c
index 305673f..54fe7a2 100644
--- a/src/pulse/util.c
+++ b/src/pulse/util.c
@@ -297,7 +297,7 @@ char *pa_path_get_filename(const char *p) {
 char *pa_get_fqdn(char *s, size_t l) {
     char hn[256];
 #ifdef HAVE_GETADDRINFO
-    struct addrinfo *a, hints;
+    struct addrinfo *a = NULL, hints;
 #endif
 
     pa_assert(s);
@@ -311,9 +311,14 @@ char *pa_get_fqdn(char *s, size_t l) {
     hints.ai_family = AF_UNSPEC;
     hints.ai_flags = AI_CANONNAME;
 
-    if (getaddrinfo(hn, NULL, &hints, &a) < 0 || !a || !a->ai_canonname || !*a->ai_canonname)
+    if (getaddrinfo(hn, NULL, &hints, &a))
         return pa_strlcpy(s, hn, l);
 
+    if (!a->ai_canonname || !*a->ai_canonname) {
+        freeaddrinfo(a);
+        return pa_strlcpy(s, hn, l);
+    }
+
     pa_strlcpy(s, a->ai_canonname, l);
     freeaddrinfo(a);
     return s;