mirror of
https://github.com/owntone/owntone-server.git
synced 2025-11-09 13:39:47 -05:00
[-] Fix alsa.c null pointer deref + some minor bugs and do some housekeeping
Thanks to Denis Denisov and cppcheck for notifying about the below. The leaks are edge cases, but the warning of dereference of avail in alsa.c points at a bug that could probably cause actual crashes. [src/evrtsp/rtsp.c:1352]: (warning) Assignment of function parameter has no effect outside the function. Did you forget dereferencing it? [src/httpd_daap.c:228]: (error) Memory leak: s [src/library.c:280]: (warning) %d in format string (no. 2) requires 'int' but the argument type is 'unsigned int'. [src/library.c:284]: (warning) %d in format string (no. 2) requires 'int' but the argument type is 'unsigned int'. [src/library/filescanner_playlist.c:251]: (error) Resource leak: fp [src/library/filescanner_playlist.c:273]: (error) Resource leak: fp [src/outputs/alsa.c:143]: (warning) Assignment of function parameter has no effect outside the function. Did you forget dereferencing it? [src/outputs/alsa.c:657]: (warning) Possible null pointer dereference: avail [src/outputs/dummy.c:75]: (warning) Assignment of function parameter has no effect outside the function. Did you forget dereferencing it? [src/outputs/fifo.c:245]: (warning) Assignment of function parameter has no effect outside the function. Did you forget dereferencing it? [src/outputs/raop.c:1806]: (warning) Assignment of function parameter has no effect outside the function. Did you forget dereferencing it? [src/outputs/raop.c:1371]: (warning) %u in format string (no. 1) requires 'unsigned int' but the argument type is 'signed int'. [src/outputs/raop.c:1471]: (warning) %u in format string (no. 1) requires 'unsigned int' but the argument type is 'signed int'. [src/outputs/raop_verification.c:705] -> [src/outputs/raop_verification.c:667]: (warning) Either the condition 'if(len_M)' is redundant or there is possible null pointer dereference: len_M.
This commit is contained in:
@@ -133,14 +133,15 @@ prebuf_free(struct alsa_session *as)
|
||||
static void
|
||||
alsa_session_free(struct alsa_session *as)
|
||||
{
|
||||
if (!as)
|
||||
return;
|
||||
|
||||
event_free(as->deferredev);
|
||||
|
||||
prebuf_free(as);
|
||||
|
||||
free(as->output_session);
|
||||
free(as);
|
||||
|
||||
as = NULL;
|
||||
}
|
||||
|
||||
static void
|
||||
@@ -654,7 +655,8 @@ buffer_write(struct alsa_session *as, uint8_t *buf, snd_pcm_sframes_t *avail, in
|
||||
if (ret != nsamp)
|
||||
DPRINTF(E_WARN, L_LAUDIO, "ALSA partial write detected\n");
|
||||
|
||||
*avail -= ret;
|
||||
if (avail)
|
||||
*avail -= ret;
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
@@ -509,6 +509,9 @@ squote_to_dquote(char *buf)
|
||||
static void
|
||||
cast_session_free(struct cast_session *cs)
|
||||
{
|
||||
if (!cs)
|
||||
return;
|
||||
|
||||
event_free(cs->reply_timeout);
|
||||
event_free(cs->ev);
|
||||
|
||||
|
||||
@@ -67,12 +67,13 @@ defer_cb(int fd, short what, void *arg);
|
||||
static void
|
||||
dummy_session_free(struct dummy_session *ds)
|
||||
{
|
||||
if (!ds)
|
||||
return;
|
||||
|
||||
event_free(ds->deferredev);
|
||||
|
||||
free(ds->output_session);
|
||||
free(ds);
|
||||
|
||||
ds = NULL;
|
||||
}
|
||||
|
||||
static void
|
||||
|
||||
@@ -237,12 +237,14 @@ fifo_empty(struct fifo_session *fifo_session)
|
||||
static void
|
||||
fifo_session_free(struct fifo_session *fifo_session)
|
||||
{
|
||||
if (!fifo_session)
|
||||
return;
|
||||
|
||||
event_free(fifo_session->deferredev);
|
||||
|
||||
free(fifo_session->output_session);
|
||||
free(fifo_session);
|
||||
free_buffer();
|
||||
fifo_session = NULL;
|
||||
}
|
||||
|
||||
static void
|
||||
|
||||
@@ -97,6 +97,9 @@ pulse_from_device_volume(int device_volume)
|
||||
static void
|
||||
pulse_session_free(struct pulse_session *ps)
|
||||
{
|
||||
if (!ps)
|
||||
return;
|
||||
|
||||
if (ps->stream)
|
||||
{
|
||||
pa_threaded_mainloop_lock(pulse.mainloop);
|
||||
|
||||
@@ -1368,7 +1368,7 @@ raop_send_req_flush(struct raop_session *rs, uint64_t rtptime, evrtsp_req_cb cb)
|
||||
}
|
||||
|
||||
/* Restart sequence: last sequence + 1 */
|
||||
ret = snprintf(buf, sizeof(buf), "seq=%u;rtptime=%u", stream_seq + 1, RAOP_RTPTIME(rtptime));
|
||||
ret = snprintf(buf, sizeof(buf), "seq=%" PRIu16 ";rtptime=%u", stream_seq + 1, RAOP_RTPTIME(rtptime));
|
||||
if ((ret < 0) || (ret >= sizeof(buf)))
|
||||
{
|
||||
DPRINTF(E_LOG, L_RAOP, "RTP-Info too big for buffer in FLUSH request\n");
|
||||
@@ -1468,7 +1468,7 @@ raop_send_req_record(struct raop_session *rs, evrtsp_req_cb cb)
|
||||
evrtsp_add_header(req->output_headers, "Range", "npt=0-");
|
||||
|
||||
/* Start sequence: next sequence */
|
||||
ret = snprintf(buf, sizeof(buf), "seq=%u;rtptime=%u", stream_seq + 1, RAOP_RTPTIME(rs->start_rtptime));
|
||||
ret = snprintf(buf, sizeof(buf), "seq=%" PRIu16 ";rtptime=%u", stream_seq + 1, RAOP_RTPTIME(rs->start_rtptime));
|
||||
if ((ret < 0) || (ret >= sizeof(buf)))
|
||||
{
|
||||
DPRINTF(E_LOG, L_RAOP, "RTP-Info too big for buffer in RECORD request\n");
|
||||
@@ -1778,6 +1778,9 @@ raop_status(struct raop_session *rs)
|
||||
static void
|
||||
raop_session_free(struct raop_session *rs)
|
||||
{
|
||||
if (!rs)
|
||||
return;
|
||||
|
||||
evrtsp_connection_set_closecb(rs->ctrl, NULL, NULL);
|
||||
|
||||
evrtsp_connection_free(rs->ctrl);
|
||||
@@ -1802,8 +1805,6 @@ raop_session_free(struct raop_session *rs)
|
||||
free(rs->output_session);
|
||||
|
||||
free(rs);
|
||||
|
||||
rs = NULL;
|
||||
}
|
||||
|
||||
static void
|
||||
@@ -3461,7 +3462,7 @@ raop_v2_resend_range(struct raop_session *rs, uint16_t seqnum, uint16_t len)
|
||||
/* Check that seqnum is in the retransmit buffer */
|
||||
if ((seqnum > pktbuf_head->seqnum) || (seqnum < pktbuf_tail->seqnum))
|
||||
{
|
||||
DPRINTF(E_WARN, L_RAOP, "Device '%s' asking for seqnum %u; not in buffer (h %u t %u)\n", rs->devname, seqnum, pktbuf_head->seqnum, pktbuf_tail->seqnum);
|
||||
DPRINTF(E_WARN, L_RAOP, "Device '%s' asking for seqnum %" PRIu16 "; not in buffer (h %" PRIu16 " t %" PRIu16 ")\n", rs->devname, seqnum, pktbuf_head->seqnum, pktbuf_tail->seqnum);
|
||||
return;
|
||||
}
|
||||
|
||||
|
||||
@@ -702,14 +702,12 @@ srp_user_process_challenge(struct SRPUser *usr, const unsigned char *bytes_s, in
|
||||
calculate_H_AMK(usr->alg, usr->H_AMK, usr->A, usr->M, usr->session_key, usr->session_key_len);
|
||||
|
||||
*bytes_M = usr->M;
|
||||
if (len_M)
|
||||
*len_M = hash_length(usr->alg);
|
||||
*len_M = hash_length(usr->alg);
|
||||
}
|
||||
else
|
||||
{
|
||||
*bytes_M = NULL;
|
||||
if (len_M)
|
||||
*len_M = 0;
|
||||
*len_M = 0;
|
||||
}
|
||||
|
||||
cleanup2:
|
||||
|
||||
Reference in New Issue
Block a user