From df612ac9b3f05f1f2ddfd5dfd4891f956759e3db Mon Sep 17 00:00:00 2001 From: Rene Gollent Date: Fri, 13 Dec 2013 17:21:35 -0500 Subject: [PATCH] Fix #10302. - In the case of an error while unflattening, BMediaRoster::GetParameterWebFor() would allocate a new parameter web object into the passed in web pointer, and then delete it again. This would result in the desklink MixerControl object having a bogus pointer in its fParameterWeb member, leading to a crash. As such, create the object in a local variable first, and only overwrite the passed in pointer on success. Furthermore, explicitly reset said pointer to NULL in desklink on failure, as _Disconnect() tries to delete it unconditionally. --- src/bin/desklink/MixerControl.cpp | 1 + src/kits/media/MediaRoster.cpp | 18 ++++++++++-------- 2 files changed, 11 insertions(+), 8 deletions(-) diff --git a/src/bin/desklink/MixerControl.cpp b/src/bin/desklink/MixerControl.cpp index ed2c5b101a..54665cb079 100644 --- a/src/bin/desklink/MixerControl.cpp +++ b/src/bin/desklink/MixerControl.cpp @@ -158,6 +158,7 @@ retry: } } else { errorString = "No parameter web"; + fParameterWeb = NULL; } } else { if (!retrying) { diff --git a/src/kits/media/MediaRoster.cpp b/src/kits/media/MediaRoster.cpp index df17e0c1be..4b13a37d85 100644 --- a/src/kits/media/MediaRoster.cpp +++ b/src/kits/media/MediaRoster.cpp @@ -2262,8 +2262,8 @@ BMediaRoster::GetParameterWebFor(const media_node& node, BParameterWeb** _web) } if (reply.size > 0) { // we got a flattened parameter web! - *_web = new (std::nothrow) BParameterWeb(); - if (*_web == NULL) + BParameterWeb* web = new (std::nothrow) BParameterWeb(); + if (web == NULL) rv = B_NO_MEMORY; else { printf("BMediaRoster::GetParameterWebFor Unflattening %" @@ -2272,13 +2272,15 @@ BMediaRoster::GetParameterWebFor(const media_node& node, BParameterWeb** _web) ((uint32*)data)[0], ((uint32*)data)[1], ((uint32*)data)[2], ((uint32*)data)[3]); - rv = (*_web)->Unflatten(reply.code, data, reply.size); - } - if (rv != B_OK) { - ERROR("BMediaRoster::GetParameterWebFor Unflatten failed, " - "%s\n", strerror(rv)); - delete *_web; + rv = web->Unflatten(reply.code, data, reply.size); + if (rv != B_OK) { + ERROR("BMediaRoster::GetParameterWebFor Unflatten failed, " + "%s\n", strerror(rv)); + delete web; + } else + *_web = web; } + delete_area(area); return rv; }