Browse Source

Bug1223: (correction). Fix new potential crash in following pointer.

With recent changes to the Nyquist code for freeing blocks, the pointer 'next' could be uninitialised when 'list' points to the zero chain.  So Audacity would follow a rogue pointer.  We'd get away with it if the uninitialised value happened to be zero.
au-ny-api
James Crook 6 years ago
parent
commit
016919a53b
  1. 2
      lib-src/libnyquist/nyquist/nyqsrc/sound.c

2
lib-src/libnyquist/nyquist/nyqsrc/sound.c

@ -528,6 +528,7 @@ void snd_list_unref(snd_list_type list)
break; // the rest of the list is shared, nothing more to free
}
next = NULL;
// list nodes either point to a block of samples or this is the
// last list node (list->block == NULL) which points to a suspension
// lists can also terminate at the zero_block, which is an infinite
@ -540,7 +541,6 @@ void snd_list_unref(snd_list_type list)
/* free suspension structure */
/* nyquist_printf("freeing susp@%p\n", list->u.susp); */
(*(list->u.susp->free))(list->u.susp);
next = NULL;
}
/* if (list == list_watch)
printf("freeing watched snd_list %p\n", list); */

Loading…
Cancel
Save