[PATCH 0/1] MR9405: dsound: Avoid use after free in DSOUND_WaveFormat (ASan).

[Bernhard Übelacker]

Contents of `mixwfe` is copied into `wfe` and `mixwfe` is freed by `CoTaskMemFree`. But then `mixwfe` is used again. This patch uses the values from `wfe`.

[This is a testbot run with this patch](https://testbot.winehq.org/JobDetails.pl?Key=160647)

[ASan details found by gitlab-CI](https://gitlab.winehq.org/bernhardu/wine/-/jobs/205270#L530)

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/9405

[PATCH 1/1] dsound: Avoid use after free in DSOUND_WaveFormat (ASan).

[Bernhard Übelacker]

From: Bernhard Übelacker <bernhardu(a)mailbox.org>

---
 dlls/dsound/primary.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dlls/dsound/primary.c b/dlls/dsound/primary.c
index 9a5557f2c83..04e66ec6461 100644
--- a/dlls/dsound/primary.c
+++ b/dlls/dsound/primary.c
@@ -128,9 +128,9 @@ static HRESULT DSOUND_WaveFormat(DirectSoundDevice *device, IAudioClient *client
         wfe.Samples.wValidBitsPerSample = wfe.Format.wBitsPerSample = 32;
 
         if (wfe.Format.nChannels < device->num_speakers) {
-            device->speaker_config = DSOUND_FindSpeakerConfig(device->mmdevice, mixwfe->Format.nChannels);
+            device->speaker_config = DSOUND_FindSpeakerConfig(device->mmdevice, wfe.Format.nChannels);
             DSOUND_ParseSpeakerConfig(device);
-        } else if (mixwfe->Format.nChannels > device->num_speakers) {
+        } else if (wfe.Format.nChannels > device->num_speakers) {
             wfe.Format.nChannels = device->num_speakers;
             wfe.dwChannelMask = speaker_config_to_channel_mask(device->speaker_config);
         }
-- 
GitLab

https://gitlab.winehq.org/wine/wine/-/merge_requests/9405

[Giovanni Mascellani (＠giomasce)]

Yeah, I missed those two references. Thanks for catching this!

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/9405#note_121860

[PATCH 0/1] MR9405: dsound: Avoid use after free in DSOUND_WaveFormat (ASan). - approved

[Giovanni Mascellani (＠giomasce)]

This merge request was approved by Giovanni Mascellani.
-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/9405

[PATCH 0/1] MR9405: dsound: Avoid use after free in DSOUND_WaveFormat (ASan). - approved

[Huw Davies (＠huw)]

This merge request was approved by Huw Davies.
-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/9405