From b0002e3b73e2d09a9eb0d815f86342dc96918ef5 Mon Sep 17 00:00:00 2001 From: Max Kellermann Date: Wed, 4 Nov 2020 16:22:40 +0100 Subject: [PATCH] filter/chain: copy the child name filter_chain_parse() passes a temporary string pointer which results in a use-after-free in the PreparedChainFilter::Child::Open() error message. --- NEWS | 2 ++ src/filter/plugins/ChainFilterPlugin.cxx | 5 +++-- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/NEWS b/NEWS index bb0190284..756259edc 100644 --- a/NEWS +++ b/NEWS @@ -1,6 +1,8 @@ ver 0.22.3 (not yet released) * playlist - add option "as_directory", making CUE file expansion optional +* filter + - fix garbage after "Audio format not supported by filter" message ver 0.22.2 (2020/10/28) * database diff --git a/src/filter/plugins/ChainFilterPlugin.cxx b/src/filter/plugins/ChainFilterPlugin.cxx index 878a4f2cb..604a8344d 100644 --- a/src/filter/plugins/ChainFilterPlugin.cxx +++ b/src/filter/plugins/ChainFilterPlugin.cxx @@ -28,6 +28,7 @@ #include #include #include +#include class ChainFilter final : public Filter { struct Child { @@ -72,7 +73,7 @@ private: class PreparedChainFilter final : public PreparedFilter { struct Child { - const char *name; + const std::string name; std::unique_ptr filter; Child(const char *_name, @@ -105,7 +106,7 @@ PreparedChainFilter::Child::Open(const AudioFormat &prev_audio_format) if (conv_audio_format != prev_audio_format) throw FormatRuntimeError("Audio format not supported by filter '%s': %s", - name, + name.c_str(), ToString(prev_audio_format).c_str()); return new_filter;