zdoom/raze-gles
0
0
Fork 0
mirror of https://github.com/ZDoom/raze-gles.git synced 2024-12-26 11:40:44 +00:00
Code Issues Projects Releases Packages Wiki Activity

Audiolib: Fix use-after-frees in Vorbis, FLAC, XA decoding

Browse source 
git-svn-id: https://svn.eduke32.com/eduke32@7684 1a8010ca-5511-0410-912e-c29ae57300e0
This commit is contained in:
hendricks266 2019-05-27 05:45:38 +00:00 committed by Christoph Oelckers
parent 19a5e86a35
commit 849b095b26
4 changed files with 18 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
source/audiolib/src/flac.cpp
View file

@ -651,15 +651,20 @@ void MV_ReleaseFLACVoice(VoiceNode *voice)
return; return;
} }
voice->rawdataptr = 0;
if (fd->stream != NULL) if (fd->stream != NULL)
{ {
FLAC__stream_decoder_finish(fd->stream); auto stream = fd->stream;
FLAC__stream_decoder_delete(fd->stream); fd->stream = nullptr;
FLAC__stream_decoder_finish(stream);
FLAC__stream_decoder_delete(stream);
} }
free(fd->block); auto block = fd->block;
voice->length = 0;
voice->sound = nullptr;
fd->block = nullptr;
free(block);
free(fd); free(fd);
voice->rawdataptr = 0;
} }
#else #else
#include "_multivc.h" #include "_multivc.h"

5
source/audiolib/src/vorbis.cpp
View file

@ -460,10 +460,11 @@ void MV_ReleaseVorbisVoice( VoiceNode * voice )
auto vd = (vorbis_data *)voice->rawdataptr; auto vd = (vorbis_data *)voice->rawdataptr;
voice->rawdataptr = 0;
voice->length = 0;
voice->sound = nullptr;
ov_clear(&vd->vf); ov_clear(&vd->vf);
free(vd); free(vd);
voice->rawdataptr = 0;
} }
#else #else
#include "_multivc.h" #include "_multivc.h"

5
source/audiolib/src/xa.cpp
View file

@ -483,7 +483,8 @@ void MV_ReleaseXAVoice( VoiceNode * voice )
return; return;
} }
free(xad);
voice->rawdataptr = 0; voice->rawdataptr = 0;
voice->length = 0;
voice->sound = nullptr;
free(xad);
} }

2
source/audiolib/src/xmp.cpp
View file

@ -196,6 +196,8 @@ void MV_ReleaseXMPVoice(VoiceNode * voice)
return; return;
voice->rawdataptr = 0; voice->rawdataptr = 0;
voice->length = 0;
voice->sound = nullptr;
xmp_end_player(xmpd->context); xmp_end_player(xmpd->context);
xmp_release_module(xmpd->context); xmp_release_module(xmpd->context);