hrev46536 adds 1 changeset to branch 'master' old head: de1fb0e4502f8db699f16d7bd08c9ff98da59030 new head: df612ac9b3f05f1f2ddfd5dfd4891f956759e3db overview: http://cgit.haiku-os.org/haiku/log/?qt=range&q=df612ac+%5Ede1fb0e ---------------------------------------------------------------------------- df612ac: Fix #10302. - In the case of an error while unflattening, BMediaRoster::GetParameterWebFor() would allocate a new parameter web object into the passed in web pointer, and then delete it again. This would result in the desklink MixerControl object having a bogus pointer in its fParameterWeb member, leading to a crash. As such, create the object in a local variable first, and only overwrite the passed in pointer on success. Furthermore, explicitly reset said pointer to NULL in desklink on failure, as _Disconnect() tries to delete it unconditionally. [ Rene Gollent <rene@xxxxxxxxxxx> ] ---------------------------------------------------------------------------- Revision: hrev46536 Commit: df612ac9b3f05f1f2ddfd5dfd4891f956759e3db URL: http://cgit.haiku-os.org/haiku/commit/?id=df612ac Author: Rene Gollent <rene@xxxxxxxxxxx> Date: Fri Dec 13 22:21:35 2013 UTC Ticket: https://dev.haiku-os.org/ticket/10302 ---------------------------------------------------------------------------- 2 files changed, 11 insertions(+), 8 deletions(-) src/bin/desklink/MixerControl.cpp | 1 + src/kits/media/MediaRoster.cpp | 18 ++++++++++-------- ---------------------------------------------------------------------------- diff --git a/src/bin/desklink/MixerControl.cpp b/src/bin/desklink/MixerControl.cpp index ed2c5b1..54665cb 100644 --- a/src/bin/desklink/MixerControl.cpp +++ b/src/bin/desklink/MixerControl.cpp @@ -158,6 +158,7 @@ retry: } } else { errorString = "No parameter web"; + fParameterWeb = NULL; } } else { if (!retrying) { diff --git a/src/kits/media/MediaRoster.cpp b/src/kits/media/MediaRoster.cpp index df17e0c..4b13a37 100644 --- a/src/kits/media/MediaRoster.cpp +++ b/src/kits/media/MediaRoster.cpp @@ -2262,8 +2262,8 @@ BMediaRoster::GetParameterWebFor(const media_node& node, BParameterWeb** _web) } if (reply.size > 0) { // we got a flattened parameter web! - *_web = new (std::nothrow) BParameterWeb(); - if (*_web == NULL) + BParameterWeb* web = new (std::nothrow) BParameterWeb(); + if (web == NULL) rv = B_NO_MEMORY; else { printf("BMediaRoster::GetParameterWebFor Unflattening %" @@ -2272,13 +2272,15 @@ BMediaRoster::GetParameterWebFor(const media_node& node, BParameterWeb** _web) ((uint32*)data)[0], ((uint32*)data)[1], ((uint32*)data)[2], ((uint32*)data)[3]); - rv = (*_web)->Unflatten(reply.code, data, reply.size); - } - if (rv != B_OK) { - ERROR("BMediaRoster::GetParameterWebFor Unflatten failed, " - "%s\n", strerror(rv)); - delete *_web; + rv = web->Unflatten(reply.code, data, reply.size); + if (rv != B_OK) { + ERROR("BMediaRoster::GetParameterWebFor Unflatten failed, " + "%s\n", strerror(rv)); + delete web; + } else + *_web = web; } + delete_area(area); return rv; }