[alsa-devel] [PATCH] alsa-lib: snd_device_name_hint misbehaving

[Takashi Iwai]

At Mon, 02 Nov 2009 12:58:20 -0500,
John Lindgren wrote:
> 
> On Mon, 2009-11-02 at 15:55 +0100, Takashi Iwai wrote:
> > Thanks.  I guess this depends on the config files.
> > Could you attach your ones?
> 
> I can reproduce with only the stock /usr/share/alsa/alsa.conf from
> Debian installed if I try to use the "null" device after
> snd_device_name_hint.  /usr/share/alsa/alsa.conf is attached.

Thanks!  I could reproduce the problem on my machine, too.

Now I think I found the culprit.  This is not in the core conf.c code,
but it's in namehint.c.  Try the patch below.

The point is that the variable "res" can be two different instances
in try_config().  One is the result of snd_config_search_definition().
In this case, res is the copied (expanded) objects.

This one is freed in the middle of try_config(), and then res is
assigned again to another one by snd_config_search_alias_hooks().
This guy is no expanded object but a reference.

However, the original code calls snd_config_free(res) no matter which
object is.  So, freeing the latter one results in the breakage of the
config tree.

The patch adds the check of the object type to be freed or not.


Takashi

---
diff --git a/src/control/namehint.c b/src/control/namehint.c
index e878f83..a134ed7 100644
--- a/src/control/namehint.c
+++ b/src/control/namehint.c
@@ -219,6 +219,7 @@ static int try_config(struct hint_list *list,
 	const char *str;
 	int err = 0, level;
 	long dev = list->device;
+	int cleanup_res = 0;
 
 	list->device_input = -1;
 	list->device_output = -1;
@@ -244,6 +245,7 @@ static int try_config(struct hint_list *list,
 	snd_lib_error_set_handler(eh);
 	if (err < 0)
 		goto __skip_add;
+	cleanup_res = 1;
 	err = -EINVAL;
 	if (snd_config_get_type(res) != SND_CONFIG_TYPE_COMPOUND)
 		goto __cleanup;
@@ -330,6 +332,7 @@ static int try_config(struct hint_list *list,
 	    	goto __hint;
 	snd_config_delete(res);
 	res = NULL;
+	cleanup_res = 0;
 	if (strchr(buf, ':') != NULL)
 		goto __ok;
 	/* find, if all parameters have a default, */
@@ -379,7 +382,7 @@ static int try_config(struct hint_list *list,
 	      	err = hint_list_add(list, buf, buf1);
 	}
       __skip_add:
-      	if (res)
+	if (res && cleanup_res)
 	      	snd_config_delete(res);
 	if (buf1)
 		free(buf1);