From 4429acfe32f7bf886396d0863a2f11f340684664 Mon Sep 17 00:00:00 2001 From: Wim Taymans Date: Wed, 24 Feb 2021 13:15:17 +0100 Subject: [PATCH] Add patch to sample destroy use after free --- ...-t-use-the-pending_sample-after-free.patch | 29 +++++++++++++++++++ pipewire.spec | 6 +++- 2 files changed, 34 insertions(+), 1 deletion(-) create mode 100644 0001-pulse-server-don-t-use-the-pending_sample-after-free.patch diff --git a/0001-pulse-server-don-t-use-the-pending_sample-after-free.patch b/0001-pulse-server-don-t-use-the-pending_sample-after-free.patch new file mode 100644 index 0000000..92425fe --- /dev/null +++ b/0001-pulse-server-don-t-use-the-pending_sample-after-free.patch @@ -0,0 +1,29 @@ +From 72acd752f68a35c40641262be1c69014170d0734 Mon Sep 17 00:00:00 2001 +From: Wim Taymans +Date: Wed, 24 Feb 2021 12:55:34 +0100 +Subject: [PATCH] pulse-server: don't use the pending_sample after free + +Destroying the sample_play will free the user_data, which is the +pending_sample info. So don't try to use the pending_sample anymore +after destroy. +--- + src/modules/module-protocol-pulse/pulse-server.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/modules/module-protocol-pulse/pulse-server.c b/src/modules/module-protocol-pulse/pulse-server.c +index c390471aa..5bc8f4537 100644 +--- a/src/modules/module-protocol-pulse/pulse-server.c ++++ b/src/modules/module-protocol-pulse/pulse-server.c +@@ -2665,8 +2665,8 @@ static void pending_sample_free(struct pending_sample *ps) + { + spa_list_remove(&ps->link); + spa_hook_remove(&ps->listener); +- sample_play_destroy(ps->play); + ps->client->ref--; ++ sample_play_destroy(ps->play); + } + + static void sample_play_ready(void *data, uint32_t index) +-- +2.26.2 + diff --git a/pipewire.spec b/pipewire.spec index f807054..1f19697 100644 --- a/pipewire.spec +++ b/pipewire.spec @@ -8,7 +8,7 @@ %global libversion %{soversion}.%(bash -c '((intversion = (%{minorversion} * 100) + %{microversion})); echo ${intversion}').0 # For rpmdev-bumpspec and releng automation -%global baserelease 6 +%global baserelease 7 #global snapdate 20210107 #global gitcommit b17db2cebc1a5ab2c01851d29c05f79cd2f262bb @@ -69,6 +69,7 @@ Patch13: 0025-bluez5-route-shouldn-t-list-a2dp-profiles-when-not-c.patch Patch14: 0027-jack-apply-PIPEWIRE_PROPS-after-reading-config.patch Patch15: 0038-jack-add-config-option-to-shorten-and-filter-names.patch Patch16: 0046-jack-fix-names-of-our-ports.patch +Patch17: 0001-pulse-server-don-t-use-the-pending_sample-after-free.patch ## upstreamable patches @@ -452,6 +453,9 @@ systemctl --no-reload preset --global pipewire.socket >/dev/null 2>&1 || : %endif %changelog +* Wed Feb 24 2021 Wim Taymans - 0.3.22-7 +- Add patch to sample destroy use after free + * Wed Feb 24 2021 Wim Taymans - 0.3.22-6 - Add patch for jack names