Aren/haiku
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix #10302.

Browse Source 
- In the case of an error while unflattening, BMediaRoster::GetParameterWebFor()
would allocate a new parameter web object into the passed in web pointer, and
then delete it again. This would result in the desklink MixerControl object having
a bogus pointer in its fParameterWeb member, leading to a crash. As such, create
the object in a local variable first, and only overwrite the passed in pointer on
success. Furthermore, explicitly reset said pointer to NULL in desklink on failure,
as _Disconnect() tries to delete it unconditionally.
This commit is contained in:
Rene Gollent 2013-12-13 17:21:35 -05:00
parent de1fb0e450
commit df612ac9b3
2 changed files with 11 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
src/bin/desklink/MixerControl.cpp
View File

@ -158,6 +158,7 @@ retry:
}
} else {
errorString = "No parameter web";
fParameterWeb = NULL;
}
} else {
if (!retrying) {

18
src/kits/media/MediaRoster.cpp
View File

@ -2262,8 +2262,8 @@ BMediaRoster::GetParameterWebFor(const media_node& node, BParameterWeb** _web)
}
if (reply.size > 0) {
// we got a flattened parameter web!
*_web = new (std::nothrow) BParameterWeb();
if (*_web == NULL)
BParameterWeb* web = new (std::nothrow) BParameterWeb();
if (web == NULL)
rv = B_NO_MEMORY;
else {
printf("BMediaRoster::GetParameterWebFor Unflattening %"
@ -2272,13 +2272,15 @@ BMediaRoster::GetParameterWebFor(const media_node& node, BParameterWeb** _web)
((uint32*)data)[0], ((uint32*)data)[1], ((uint32*)data)[2],
((uint32*)data)[3]);
rv = (*_web)->Unflatten(reply.code, data, reply.size);
}
if (rv != B_OK) {
ERROR("BMediaRoster::GetParameterWebFor Unflatten failed, "
"%s\n", strerror(rv));
delete *_web;
rv = web->Unflatten(reply.code, data, reply.size);
if (rv != B_OK) {
ERROR("BMediaRoster::GetParameterWebFor Unflatten failed, "
"%s\n", strerror(rv));
delete web;
} else
*_web = web;
}
delete_area(area);
return rv;
}