[pulseaudio-discuss] [PATCH] combine: Fix crash in output freeing

[Arun Raghavan]

On Tue, 2013-06-18 at 21:21 +0300, Tanu Kaskinen wrote:
> The outputs are removed from the idxset before output_free() is
> called. Trying to remove them again in output_free(), and asserting
> that it should succeed caused crashing whenever outputs were freed.
> 
> This bug was introduced in commit
> 061878b5a47ed9aa05d12430b039874b63c29a84.
> 
> BugLink: https://bugs.freedesktop.org/show_bug.cgi?id=65901
> ---
> 
> Perhaps this bug is serious enough to warrant a bugfix release?
> 
>  src/modules/module-combine-sink.c | 2 --
>  1 file changed, 2 deletions(-)
> 
> diff --git a/src/modules/module-combine-sink.c b/src/modules/module-combine-sink.c
> index 7d660f0..faf65c2 100644
> --- a/src/modules/module-combine-sink.c
> +++ b/src/modules/module-combine-sink.c
> @@ -923,8 +923,6 @@ static void output_free(struct output *o) {
>      pa_assert(o);
>  
>      output_disable(o);
> -
> -    pa_assert_se(pa_idxset_remove_by_data(o->userdata->outputs, o, NULL));
>      update_description(o->userdata);
>  
>      if (o->inq_rtpoll_item_read)

output_free() is also called from pa__done() without first freeing the
idxset.

-- Arun