From fa97a5b77c73a2c40329be8a5b2734900541cf7a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Barnab=C3=A1s=20P=C5=91cze?= Date: Sat, 27 Apr 2024 15:08:45 +0200 Subject: [PATCH] pipewire: utils: pw_strv_parse(): fix freeing in case of error When iterating a pw_array of `T`, the iterator must be of type `T*`. Otherwise the wrong pointer will be freed. Fixes: 4a19a76dc1602a ("utils: improve pw_strv_parse") Reported-by: Coverity Scan --- src/pipewire/utils.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/src/pipewire/utils.c b/src/pipewire/utils.c index 732806472..4db73a049 100644 --- a/src/pipewire/utils.c +++ b/src/pipewire/utils.c @@ -131,7 +131,6 @@ char **pw_strv_parse(const char *val, size_t len, int max_tokens, int *n_tokens) { struct pw_array arr; struct spa_json it[2]; - char *s, **result; int n = 0, l, res; const char *value; struct spa_error_location el; @@ -146,6 +145,8 @@ char **pw_strv_parse(const char *val, size_t len, int max_tokens, int *n_tokens) spa_json_init(&it[1], val, len); while ((l = spa_json_next(&it[1], &value)) > 0 && n + 1 < max_tokens) { + char *s; + if ((s = malloc(l+1)) == NULL) goto error_errno; @@ -163,8 +164,10 @@ done: if ((res = spa_json_get_error(&it[1], val, &el))) { spa_debug_log_error_location(pw_log_get(), SPA_LOG_LEVEL_WARN, &el, "error parsing strv: %s", el.reason); + + char **s; pw_array_for_each(s, &arr) - free(s); + free(*s); pw_array_clear(&arr); n = 0; }