fork of PCE focusing on macplus, supporting DaynaPort SCSI network emulation
sound: Fix use after free bug in snd_close()
Bug reported by Philippe Elie
+29
-13
+3
-1
src/drivers/sound/sound-null.c
+3
-1
src/drivers/sound/sound-null.c
···
5
5
/*****************************************************************************
6
6
* File name: src/drivers/sound/sound-null.c *
7
7
* Created: 2009-10-17 by Hampa Hug <hampa@hampa.ch> *
8
-
* Copyright: (C) 2009-2011 Hampa Hug <hampa@hampa.ch> *
8
+
* Copyright: (C) 2009-2017 Hampa Hug <hampa@hampa.ch> *
9
9
*****************************************************************************/
10
10
11
11
/*****************************************************************************
···
34
34
sound_null_t *drv;
35
35
36
36
drv = sdrv->ext;
37
+
38
+
snd_free (sdrv);
37
39
38
40
free (drv);
39
41
}
+3
-1
src/drivers/sound/sound-oss.c
+3
-1
src/drivers/sound/sound-oss.c
···
5
5
/*****************************************************************************
6
6
* File name: src/drivers/sound/sound-oss.c *
7
7
* Created: 2009-10-17 by Hampa Hug <hampa@hampa.ch> *
8
-
* Copyright: (C) 2009-2010 Hampa Hug <hampa@hampa.ch> *
8
+
* Copyright: (C) 2009-2017 Hampa Hug <hampa@hampa.ch> *
9
9
*****************************************************************************/
10
10
11
11
/*****************************************************************************
···
53
53
if (drv->dev != NULL) {
54
54
free (drv->dev);
55
55
}
56
+
57
+
snd_free (sdrv);
56
58
57
59
free (drv);
58
60
}
+3
-1
src/drivers/sound/sound-sdl.c
+3
-1
src/drivers/sound/sound-sdl.c
···
5
5
/*****************************************************************************
6
6
* File name: src/drivers/sound/sound-oss.c *
7
7
* Created: 2010-08-12 by Hampa Hug <hampa@hampa.ch> *
8
-
* Copyright: (C) 2010 Hampa Hug <hampa@hampa.ch> *
8
+
* Copyright: (C) 2010-2017 Hampa Hug <hampa@hampa.ch> *
9
9
*****************************************************************************/
10
10
11
11
/*****************************************************************************
···
115
115
116
116
snd_sdl_buf_free_list (drv->head);
117
117
snd_sdl_buf_free_list (drv->free);
118
+
119
+
snd_free (sdrv);
118
120
119
121
free (drv);
120
122
}
+17
-9
src/drivers/sound/sound.c
+17
-9
src/drivers/sound/sound.c
···
5
5
/*****************************************************************************
6
6
* File name: src/drivers/sound/sound.c *
7
7
* Created: 2009-10-17 by Hampa Hug <hampa@hampa.ch> *
8
-
* Copyright: (C) 2009-2010 Hampa Hug <hampa@hampa.ch> *
8
+
* Copyright: (C) 2009-2017 Hampa Hug <hampa@hampa.ch> *
9
9
*****************************************************************************/
10
10
11
11
/*****************************************************************************
···
170
170
sdrv->set_params = NULL;
171
171
}
172
172
173
+
void snd_free (sound_drv_t *sdrv)
174
+
{
175
+
if (sdrv->sbuf != NULL) {
176
+
free (sdrv->sbuf);
177
+
sdrv->sbuf = NULL;
178
+
sdrv->sbuf_max = 0;
179
+
}
180
+
181
+
if (sdrv->bbuf != NULL) {
182
+
free (sdrv->bbuf);
183
+
sdrv->bbuf = NULL;
184
+
sdrv->bbuf_max = 0;
185
+
}
186
+
}
187
+
173
188
void snd_close (sound_drv_t *sdrv)
174
189
{
175
190
if (sdrv == NULL) {
···
181
196
if (sdrv->close != NULL) {
182
197
sdrv->close (sdrv);
183
198
}
184
-
185
-
if (sdrv->sbuf != NULL) {
186
-
free (sdrv->sbuf);
187
-
}
199
+
}
188
200
189
-
if (sdrv->bbuf != NULL) {
190
-
free (sdrv->bbuf);
191
-
}
192
-
}
193
201
194
202
const uint16_t *snd_filter (sound_drv_t *sdrv, const uint16_t *buf, unsigned cnt)
195
203
{
+3
-1
src/drivers/sound/sound.h
+3
-1
src/drivers/sound/sound.h
···
5
5
/*****************************************************************************
6
6
* File name: src/drivers/sound/sound.h *
7
7
* Created: 2009-10-17 by Hampa Hug <hampa@hampa.ch> *
8
-
* Copyright: (C) 2009-2010 Hampa Hug <hampa@hampa.ch> *
8
+
* Copyright: (C) 2009-2017 Hampa Hug <hampa@hampa.ch> *
9
9
*****************************************************************************/
10
10
11
11
/*****************************************************************************
···
102
102
103
103
104
104
void snd_init (sound_drv_t *sdrv, void *ext);
105
+
106
+
void snd_free (sound_drv_t *sdrv);
105
107
106
108
void snd_close (sound_drv_t *sdrv);
107
109