From 0325f4357d25f262400038f074512e1887c8e5f1 Mon Sep 17 00:00:00 2001 From: Jaroslav Kysela Date: Thu, 3 Jun 2021 09:00:51 +0200 Subject: [PATCH] ucm: compound_merge() - fix use after free (and logic) Signed-off-by: Jaroslav Kysela --- src/ucm/ucm_include.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/src/ucm/ucm_include.c b/src/ucm/ucm_include.c index 6945dd2e..a3a584a1 100644 --- a/src/ucm/ucm_include.c +++ b/src/ucm/ucm_include.c @@ -108,7 +108,7 @@ static int find_position_node(snd_config_t **res, snd_config_t *dst, return 0; } -static int merge_it(snd_config_t *dst, snd_config_t *n) +static int merge_it(snd_config_t *dst, snd_config_t *n, snd_config_t **_dn) { snd_config_t *dn; const char *id; @@ -123,6 +123,8 @@ static int merge_it(snd_config_t *dst, snd_config_t *n) err = snd_config_merge(dn, n, 0); /* merge / append mode */ if (err < 0) snd_config_delete(n); + else + *_dn = dn; return err; } @@ -198,7 +200,7 @@ static int compound_merge(const char *id, if (_before) { err = snd_config_add_before(_before, n); if (err == -EEXIST) - err = merge_it(dst, n); + err = merge_it(dst, n, &n); if (err < 0) return err; _before = NULL; @@ -206,7 +208,7 @@ static int compound_merge(const char *id, } else if (_after) { err = snd_config_add_after(_after, n); if (err == -EEXIST) - err = merge_it(dst, n); + err = merge_it(dst, n, &n); if (err < 0) return err; _after = n; -- 2.47.3