[PATCH 0/1] MR9019: libs/fluidsynth: Fix memory leak / use-after-free crash due to incorrect refcounting
FluidSynth settings table is internally a refcounted hashtable. Due to wrong glib atomic emulation, the hashtable might be leaked (if refcount != 2) or abruptly freed (if refcount == 2) due to incorrect return value from `fluid_atomic_int_exchange_and_add()`. -- https://gitlab.winehq.org/wine/wine/-/merge_requests/9019
From: Jinoh Kang <jinoh.kang.kr(a)gmail.com> FluidSynth settings table is internally a refcounted hashtable. Due to wrong glib atomic emulation, the hashtable might be leaked (if refcount != 2) or abruptly freed (if refcount == 2) due to incorrect return value from `fluid_atomic_int_exchange_and_add()`. Fixes: f768d6b31bebc35fbaf751d0cd57c8bd302a8d60 --- libs/fluidsynth/glib.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libs/fluidsynth/glib.h b/libs/fluidsynth/glib.h index 6bbd5acc75e..a2cfd2c743d 100644 --- a/libs/fluidsynth/glib.h +++ b/libs/fluidsynth/glib.h @@ -100,7 +100,7 @@ static inline void g_cond_broadcast( GCond *cond ) { WakeAllConditionVariable( c static inline void g_cond_wait( GCond *cond, GMutex *mutex ) { SleepConditionVariableSRW( cond, mutex, INFINITE, 0 ); } static inline void g_atomic_int_inc( int *ptr ) { InterlockedIncrement( (LONG *)ptr ); } -static inline int g_atomic_int_add( int *ptr, int val ) { return InterlockedAdd( (LONG *)ptr, val ) - 1; } +static inline int g_atomic_int_add( int *ptr, int val ) { return InterlockedAdd( (LONG *)ptr, val ) - val; } static inline int g_atomic_int_get( int *ptr ) { return ReadAcquire( (LONG *)ptr ); } static inline void g_atomic_int_set( int *ptr, int val ) { InterlockedExchange( (LONG *)ptr, val ); } static inline int g_atomic_int_dec_and_test( int *ptr, int val ) { return !InterlockedAdd( (LONG *)ptr, -val ); } -- GitLab https://gitlab.winehq.org/wine/wine/-/merge_requests/9019
This merge request was approved by Huw Davies. -- https://gitlab.winehq.org/wine/wine/-/merge_requests/9019
This merge request was approved by Rémi Bernon. -- https://gitlab.winehq.org/wine/wine/-/merge_requests/9019
participants (4)
-
Huw Davies (＠huw) -
Jinoh Kang
-
Jinoh Kang (＠iamahuman)
-
Rémi Bernon