[pulseaudio-discuss] [PATCH] combine: Fix crash in output freeing

[Arun Raghavan]

On Wed, 2013-06-19 at 16:45 +0300, Tanu Kaskinen wrote:
> On Wed, 2013-06-19 at 17:10 +0530, Arun Raghavan wrote:
> > On Tue, 2013-06-18 at 21:21 +0300, Tanu Kaskinen wrote:
> > > The outputs are removed from the idxset before output_free() is
> > > called. Trying to remove them again in output_free(), and asserting
> > > that it should succeed caused crashing whenever outputs were freed.
> > > 
> > > This bug was introduced in commit
> > > 061878b5a47ed9aa05d12430b039874b63c29a84.
> > > 
> > > BugLink: https://bugs.freedesktop.org/show_bug.cgi?id=65901
> > > ---
> > > 
> > > Perhaps this bug is serious enough to warrant a bugfix release?
> > > 
> > >  src/modules/module-combine-sink.c | 2 --
> > >  1 file changed, 2 deletions(-)
> > > 
> > > diff --git a/src/modules/module-combine-sink.c b/src/modules/module-combine-sink.c
> > > index 7d660f0..faf65c2 100644
> > > --- a/src/modules/module-combine-sink.c
> > > +++ b/src/modules/module-combine-sink.c
> > > @@ -923,8 +923,6 @@ static void output_free(struct output *o) {
> > >      pa_assert(o);
> > >  
> > >      output_disable(o);
> > > -
> > > -    pa_assert_se(pa_idxset_remove_by_data(o->userdata->outputs, o, NULL));
> > >      update_description(o->userdata);
> > >  
> > >      if (o->inq_rtpoll_item_read)
> > 
> > output_free() is also called from pa__done() without first freeing the
> > idxset.
> 
> Yes. Is that a problem?

I misread that bit. Patch looks good, please go ahead and push it.

-- Arun