[PATCH 0/1] MR8439: faudio: Fix use-after-free in FAudioVoice_DestroyVoiceSafeEXT.

[Yuxuan Shui (＠yshui)]

Use of voice->audio in LOG_API_EXIT after voice has been freed.

Upstream commit:
https://github.com/FNA-XNA/FAudio/commit/3b7037e413a4ad72fd5d3af6f2c475251dd...

* * *

Could also just wait for the next faudio release, your call.

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/8439

[PATCH 1/1] faudio: Fix use-after-free in FAudioVoice_DestroyVoiceSafeEXT.

[Yuxuan Shui]

From: Yuxuan Shui <yshui(a)codeweavers.com>

Use of voice->audio in LOG_API_EXIT after voice has been freed.

Upstream commit:
https://github.com/FNA-XNA/FAudio/commit/3b7037e413a4ad72fd5d3af6f2c475251dd...
---
 libs/faudio/src/FAudio.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/libs/faudio/src/FAudio.c b/libs/faudio/src/FAudio.c
index 3eb49bc3d01..c10347965ab 100644
--- a/libs/faudio/src/FAudio.c
+++ b/libs/faudio/src/FAudio.c
@@ -2507,21 +2507,22 @@ static void destroy_voice(FAudioVoice *voice)
 uint32_t FAudioVoice_DestroyVoiceSafeEXT(FAudioVoice *voice)
 {
 	uint32_t ret;
+	FAudio *audio = voice->audio;
 
-	LOG_API_ENTER(voice->audio)
+	LOG_API_ENTER(audio)
 
 	if ((ret = check_for_sends_to_voice(voice)))
 	{
 		LOG_ERROR(
-			voice->audio,
+			audio,
 			"Voice %p is an output for other voice(s)",
 			voice
 		)
-		LOG_API_EXIT(voice->audio)
+		LOG_API_EXIT(audio)
 		return ret;
 	}
 	destroy_voice(voice);
-	LOG_API_EXIT(voice->audio)
+	LOG_API_EXIT(audio)
 	return 0;
 }
 
-- 
GitLab

https://gitlab.winehq.org/wine/wine/-/merge_requests/8439

[PATCH 0/1] MR8439: faudio: Fix use-after-free in FAudioVoice_DestroyVoiceSafeEXT. - closed

[Alexandre Julliard (＠julliard)]

This merge request was closed by Alexandre Julliard.
-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/8439

[Alexandre Julliard (＠julliard)]

Upstream release was merged in 348291cb4e58e40ea3d67eac0f4983da7691d092.

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/8439#note_109009