[libgnome-volume-control] gvc-mixer-control: Fix double-free when setting headset



commit a28e23d9006a32c8982ad8bda11fec131c6b36e8
Author: Bastien Nocera <hadess hadess net>
Date:   Mon Feb 22 14:00:32 2016 +0100

    gvc-mixer-control: Fix double-free when setting headset
    
    The callbacks will be called repeatedly, once with data, and later
    on with eol == 0. Make sure to only free it when we get the eol call
    instead of once we've applied the settings.
    
    Example valgrind output:
    ==31715== Invalid read of size 8
    ==31715==    at 0x24529E09: port_status_data_free (gvc-mixer-control.c:2079)
    ==31715==    by 0x1DB81344: ??? (in /usr/lib64/libpulse.so.0.18.2)
    ==31715==    by 0x1DDF3FE0: ??? (in /usr/lib64/pulseaudio/libpulsecommon-7.1.so)
    ==31715==    by 0x1DDF436A: pa_pdispatch_run (in /usr/lib64/pulseaudio/libpulsecommon-7.1.so)
    ==31715==    by 0x1DB7507D: ??? (in /usr/lib64/libpulse.so.0.18.2)
    ==31715==    by 0x1DDF6B5E: ??? (in /usr/lib64/pulseaudio/libpulsecommon-7.1.so)
    ==31715==    by 0x1DDF91BA: ??? (in /usr/lib64/pulseaudio/libpulsecommon-7.1.so)
    ==31715==    by 0x1DDF9568: ??? (in /usr/lib64/pulseaudio/libpulsecommon-7.1.so)
    ==31715==    by 0x1DDF9DF9: ??? (in /usr/lib64/pulseaudio/libpulsecommon-7.1.so)
    ==31715==    by 0x1D96202A: ??? (in /usr/lib64/libpulse-mainloop-glib.so.0.0.5)
    ==31715==    by 0x7AA7CF9: g_main_dispatch (gmain.c:3154)
    ==31715==    by 0x7AA7CF9: g_main_context_dispatch (gmain.c:3769)
    ==31715==    by 0x7AA8057: g_main_context_iterate.isra.29 (gmain.c:3840)
    ==31715==  Address 0x2bd83480 is 0 bytes inside a block of size 16 free'd
    ==31715==    at 0x4C2ED6A: free (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
    ==31715==    by 0x7AAD2AD: g_free (gmem.c:189)
    ==31715==    by 0x1DB81562: ??? (in /usr/lib64/libpulse.so.0.18.2)
    ==31715==    by 0x1DDF3FE0: ??? (in /usr/lib64/pulseaudio/libpulsecommon-7.1.so)
    ==31715==    by 0x1DDF436A: pa_pdispatch_run (in /usr/lib64/pulseaudio/libpulsecommon-7.1.so)
    ==31715==    by 0x1DB7507D: ??? (in /usr/lib64/libpulse.so.0.18.2)
    ==31715==    by 0x1DDF6B5E: ??? (in /usr/lib64/pulseaudio/libpulsecommon-7.1.so)
    ==31715==    by 0x1DDF91BA: ??? (in /usr/lib64/pulseaudio/libpulsecommon-7.1.so)
    ==31715==    by 0x1DDF9568: ??? (in /usr/lib64/pulseaudio/libpulsecommon-7.1.so)
    ==31715==    by 0x1DDF9DF9: ??? (in /usr/lib64/pulseaudio/libpulsecommon-7.1.so)
    ==31715==    by 0x1D96202A: ??? (in /usr/lib64/libpulse-mainloop-glib.so.0.0.5)
    ==31715==    by 0x7AA7CF9: g_main_dispatch (gmain.c:3154)
    ==31715==    by 0x7AA7CF9: g_main_context_dispatch (gmain.c:3769)
    ==31715==  Block was alloc'd at
    ==31715==    at 0x4C2F9C7: calloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
    ==31715==    by 0x7AAD1F0: g_malloc0 (gmem.c:124)
    ==31715==    by 0x2452A39D: gvc_mixer_control_set_port_status_for_headset (gvc-mixer-control.c:2173)
    ==31715==    by 0x2451BE81: audio_selection_done (gsd-media-keys-manager.c:2489)
    ==31715==    by 0x7550ED3: emit_signal_instance_in_idle_cb (gdbusconnection.c:3701)
    ==31715==    by 0x7AA7CF9: g_main_dispatch (gmain.c:3154)
    ==31715==    by 0x7AA7CF9: g_main_context_dispatch (gmain.c:3769)
    ==31715==    by 0x7AA8057: g_main_context_iterate.isra.29 (gmain.c:3840)
    ==31715==    by 0x7AA8371: g_main_loop_run (gmain.c:4034)
    ==31715==    by 0x5CEA204: gtk_main (gtkmain.c:1246)
    ==31715==    by 0x403804: main (main.c:434)

 gvc-mixer-control.c |    2 --
 1 files changed, 0 insertions(+), 2 deletions(-)
---
diff --git a/gvc-mixer-control.c b/gvc-mixer-control.c
index 67ac412..ab3dbc9 100644
--- a/gvc-mixer-control.c
+++ b/gvc-mixer-control.c
@@ -2122,7 +2122,6 @@ sink_info_cb (pa_context         *c,
 
         o = pa_context_set_sink_port_by_index (c, i->index, s, NULL, NULL);
         g_clear_pointer (&o, pa_operation_unref);
-        port_status_data_free (data);
 }
 
 static void
@@ -2158,7 +2157,6 @@ source_info_cb (pa_context           *c,
 
         o = pa_context_set_source_port_by_index(c, i->index, s, NULL, NULL);
         g_clear_pointer (&o, pa_operation_unref);
-        port_status_data_free (data);
 }
 
 static void


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]