From: Kui Wang wangkuisuper@hotmail.com

When pulse_hw_constraint returns error, snd_pcm_ioplug_delete() is called. It will then call pulse_close() where "snd_pcm_pulse_t *pcm" will be free. Then if goto the "error" label, the "snd_pcm_pulse_t *pcm" will be double-free.

To prevent this, just jump over the code which might cause double-free.

Signed-off-by: Kui Wang wangkuisuper@hotmail.com

diff --git a/pulse/pcm_pulse.c b/pulse/pcm_pulse.c index 5cb3452..a8983c6 100644 --- a/pulse/pcm_pulse.c +++ b/pulse/pcm_pulse.c @@ -1143,7 +1143,7 @@ SND_PCM_PLUGIN_DEFINE_FUNC(pulse) err = pulse_hw_constraint(pcm); if (err < 0) { snd_pcm_ioplug_delete(&pcm->io); - goto error; + goto error2; }

*pcmp = pcm->io.pcm; @@ -1156,6 +1156,7 @@ error: free(pcm->device); free(pcm);

+error2: if (fallback_name) return snd_pcm_open_fallback(pcmp, root, fallback_name, name, stream, mode);