[pulseaudio-discuss] [PATCH v2 15/19] core: Use after free in pa_sink_input_new_data_set_formats() and pa_source_output_new_data_set_formats()

[Peter Meerwald]

From: Peter Meerwald <p.meerwald at bct-electronic.com>

intention is to free old data_req->formats before assigning
new formats, discovered by coverity

Signed-off-by: Peter Meerwald <pmeerw at pmeerw.net>
---
 src/pulsecore/sink-input.c    |    2 +-
 src/pulsecore/source-output.c |    2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/pulsecore/sink-input.c b/src/pulsecore/sink-input.c
index b002467..8052724 100644
--- a/src/pulsecore/sink-input.c
+++ b/src/pulsecore/sink-input.c
@@ -218,7 +218,7 @@ bool pa_sink_input_new_data_set_formats(pa_sink_input_new_data *data, pa_idxset
     pa_assert(formats);
 
     if (data->req_formats)
-        pa_idxset_free(formats, (pa_free_cb_t) pa_format_info_free);
+        pa_idxset_free(data->req_formats, (pa_free_cb_t) pa_format_info_free);
 
     data->req_formats = formats;
 
diff --git a/src/pulsecore/source-output.c b/src/pulsecore/source-output.c
index 7b78002..834a418 100644
--- a/src/pulsecore/source-output.c
+++ b/src/pulsecore/source-output.c
@@ -161,7 +161,7 @@ bool pa_source_output_new_data_set_formats(pa_source_output_new_data *data, pa_i
     pa_assert(formats);
 
     if (data->req_formats)
-        pa_idxset_free(formats, (pa_free_cb_t) pa_format_info_free);
+        pa_idxset_free(data->req_formats, (pa_free_cb_t) pa_format_info_free);
 
     data->req_formats = formats;
 
-- 
1.7.9.5