oysteikt
/
mpd
0
0
Fork 0
Code Issues Pull Requests Releases Activity

filter/chain: copy the child name 

filter_chain_parse() passes a temporary string pointer which results
in a use-after-free in the PreparedChainFilter::Child::Open() error
message.
This commit is contained in:
Max Kellermann 2020-11-04 16:22:40 +01:00
parent 27c589da97
commit b0002e3b73
2 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
NEWS
View File

@ -1,6 +1,8 @@
ver 0.22.3 (not yet released) ver 0.22.3 (not yet released)
* playlist * playlist
- add option "as_directory", making CUE file expansion optional - add option "as_directory", making CUE file expansion optional
* filter
- fix garbage after "Audio format not supported by filter" message
ver 0.22.2 (2020/10/28) ver 0.22.2 (2020/10/28)
* database * database

5
src/filter/plugins/ChainFilterPlugin.cxx
View File

@ -28,6 +28,7 @@
#include <cassert> #include <cassert>
#include <list> #include <list>
#include <memory> #include <memory>
#include <string>
class ChainFilter final : public Filter { class ChainFilter final : public Filter {
struct Child { struct Child {
@ -72,7 +73,7 @@ private:
class PreparedChainFilter final : public PreparedFilter { class PreparedChainFilter final : public PreparedFilter {
struct Child { struct Child {
const char *name; const std::string name;
std::unique_ptr<PreparedFilter> filter; std::unique_ptr<PreparedFilter> filter;
Child(const char *_name, Child(const char *_name,
@ -105,7 +106,7 @@ PreparedChainFilter::Child::Open(const AudioFormat &prev_audio_format)
if (conv_audio_format != prev_audio_format) if (conv_audio_format != prev_audio_format)
throw FormatRuntimeError("Audio format not supported by filter '%s': %s", throw FormatRuntimeError("Audio format not supported by filter '%s': %s",
name, name.c_str(),
ToString(prev_audio_format).c_str()); ToString(prev_audio_format).c_str());
return new_filter; return new_filter;