From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!not-for-mail From: Eric Wong Newsgroups: gmane.comp.audio.sox.devel Subject: Re: [PATCH] hcom: fix double free on writing zero-length file Date: Mon, 7 Sep 2015 01:05:36 +0000 Message-ID: <20150907010536.GA9338@dcvr.yhbt.net> References: <1440848285-17853-1-git-send-email-mans@mansr.com> Reply-To: sox-devel@lists.sourceforge.net NNTP-Posting-Host: plane.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Trace: ger.gmane.org 1441587954 14835 80.91.229.3 (7 Sep 2015 01:05:54 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Mon, 7 Sep 2015 01:05:54 +0000 (UTC) To: sox-devel@lists.sourceforge.net Original-X-From: sox-devel-bounces@lists.sourceforge.net Mon Sep 07 03:05:49 2015 Return-path: Envelope-to: gcasd-sox-devel@m.gmane.org X-ACL-Warn: Content-Disposition: inline In-Reply-To: <1440848285-17853-1-git-send-email-mans@mansr.com> X-Spam-Score: -1.0 (-) X-Spam-Report: Spam Filtering performed by mx.sourceforge.net. See http://spamassassin.org/tag/ for more details. -1.0 RP_MATCHES_RCVD Envelope sender domain matches handover relay domain X-Headers-End: 1ZYksP-0007PW-Qw X-BeenThere: sox-devel@lists.sourceforge.net X-Mailman-Version: 2.1.9 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: sox-devel-bounces@lists.sourceforge.net Xref: news.gmane.org gmane.comp.audio.sox.devel:418 Archived-At: Received: from lists.sourceforge.net ([216.34.181.88]) by plane.gmane.org with esmtp (Exim 4.69) (envelope-from ) id 1ZYksW-0000eG-N7 for gcasd-sox-devel@m.gmane.org; Mon, 07 Sep 2015 03:05:48 +0200 Received: from localhost ([127.0.0.1] helo=sfs-ml-1.v29.ch3.sourceforge.com) by sfs-ml-1.v29.ch3.sourceforge.com with esmtp (Exim 4.76) (envelope-from ) id 1ZYksS-00038E-54; Mon, 07 Sep 2015 01:05:44 +0000 Received: from sog-mx-2.v43.ch3.sourceforge.com ([172.29.43.192] helo=mx.sourceforge.net) by sfs-ml-1.v29.ch3.sourceforge.com with esmtp (Exim 4.76) (envelope-from ) id 1ZYksQ-000386-TV for sox-devel@lists.sourceforge.net; Mon, 07 Sep 2015 01:05:42 +0000 Received: from dcvr.yhbt.net ([64.71.152.64]) by sog-mx-2.v43.ch3.sourceforge.com with esmtp (Exim 4.76) id 1ZYksP-0007PW-Qw for sox-devel@lists.sourceforge.net; Mon, 07 Sep 2015 01:05:42 +0000 Received: from localhost (dcvr.yhbt.net [127.0.0.1]) by dcvr.yhbt.net (Postfix) with ESMTP id 3A87663386A; Mon, 7 Sep 2015 01:05:36 +0000 (UTC) Mans Rullgard wrote: > +++ b/src/hcom.c > @@ -432,9 +432,10 @@ static int stopwrite(sox_format_t * ft) > int rc = SOX_SUCCESS; > > /* Compress it all at once */ > - if (compressed_len) > + if (compressed_len) { > compress(ft, &compressed_data, (int32_t *)&compressed_len); > - free(p->data); > + free(p->data); > + } Tested successfully with: sox $INPUT x.hcom trim 0 A side note: As somebody who has never heard of hcom until now, much less read the code, it was not immediately obvious to me what the problem was or whether it introduced a new leaks until I skimmed through the entire stopwrite and compress functions :x ------------------------------------------------------------------------------