[Bug 28632] New: dlls/winealsa.drv/mmdevdrv.c!AUDDRV_GetAudioEndpoint:use-after-free on error exit path

http://bugs.winehq.org/show_bug.cgi?id=28632

Bug #: 28632
           Summary: dlls/winealsa.drv/mmdevdrv.c!AUDDRV_GetAudioEndpoint:u
                    se-after-free on error exit path
           Product: Wine
           Version: 1.3.29
          Platform: x86
        OS/Version: Linux
            Status: UNCONFIRMED
          Severity: trivial
          Priority: P3
         Component: winealsa.drv
        AssignedTo: [e-mail]
        ReportedBy: [e-mail]
    Classification: Unclassified

In dlls/winealsa.drv/mmdevdrv.c!AUDDRV_GetAudioEndpoint, the error exit path
for failure to allocate This->hw_params frees This, then calls snd_pcm_close on
This->pcm_handle.  This is lines 625-626 in commit
c9a8d3bd8906932130cd98b667574031895f83f0, the value of master at the time of
this writing.  This is unlikely to cause problems in regular usage, since it
only occurs on failure to HeapAlloc hw_params and accesses the freed memory
immediately after freeing it.  However, as a use-after-free, it is worth fixing
on principle.

This was found accidentally via code inspection while trying (unsuccessfully)
to understand why Wine 1.3.28's ALSA code acquires exclusive access to the
output device.  However, the use-after-free is still present in master.

[Bug 28632] dlls/winealsa.drv/mmdevdrv.c!AUDDRV_GetAudioEndpoint:use-after-free on error exit path

http://bugs.winehq.org/show_bug.cgi?id=28632

Jerome Leclanche  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
      Fixed by SHA1|                            |f2c33ae17ab5138fe47e3926be2
                   |                            |7b7e5fbaf0a18
             Status|UNCONFIRMED                 |RESOLVED
                 CC|                            |[e-mail]
         Resolution|                            |FIXED

--- Comment #1 from Jerome Leclanche  2012-01-23 11:59:25 CST ---
Fixed by f2c33ae17ab5138fe47e3926be27b7e5fbaf0a18.

[Bug 28632] dlls/winealsa.drv/mmdevdrv.c!AUDDRV_GetAudioEndpoint:use-after-free on error exit path

http://bugs.winehq.org/show_bug.cgi?id=28632

Alexandre Julliard  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |CLOSED

--- Comment #2 from Alexandre Julliard  2012-01-27 14:17:21 CST ---
Closing bugs fixed in 1.4-rc1.