[pulseaudio-discuss] [PATCH] combine: Fix crash in output freeing

[Tanu Kaskinen]

On Wed, 2013-06-19 at 17:10 +0530, Arun Raghavan wrote:
> On Tue, 2013-06-18 at 21:21 +0300, Tanu Kaskinen wrote:
> > The outputs are removed from the idxset before output_free() is
> > called. Trying to remove them again in output_free(), and asserting
> > that it should succeed caused crashing whenever outputs were freed.
> > 
> > This bug was introduced in commit
> > 061878b5a47ed9aa05d12430b039874b63c29a84.
> > 
> > BugLink: https://bugs.freedesktop.org/show_bug.cgi?id=65901
> > ---
> > 
> > Perhaps this bug is serious enough to warrant a bugfix release?
> > 
> >  src/modules/module-combine-sink.c | 2 --
> >  1 file changed, 2 deletions(-)
> > 
> > diff --git a/src/modules/module-combine-sink.c b/src/modules/module-combine-sink.c
> > index 7d660f0..faf65c2 100644
> > --- a/src/modules/module-combine-sink.c
> > +++ b/src/modules/module-combine-sink.c
> > @@ -923,8 +923,6 @@ static void output_free(struct output *o) {
> >      pa_assert(o);
> >  
> >      output_disable(o);
> > -
> > -    pa_assert_se(pa_idxset_remove_by_data(o->userdata->outputs, o, NULL));
> >      update_description(o->userdata);
> >  
> >      if (o->inq_rtpoll_item_read)
> 
> output_free() is also called from pa__done() without first freeing the
> idxset.

Yes. Is that a problem?

-- 
Tanu