| 0 | |
From: Sam Lantinga <slouken@libsdl.org>
|
| 1 | |
Date: Wed, 20 Jan 2021 10:17:10 -0800
|
| 2 | |
Subject: Fixed use-after-free in music_fluidsynth.c
|
| 3 | |
|
| 4 | |
There is a dangerous use-after-free in FLUIDSYNTH_Delete(): the settings
|
| 5 | |
object is deleted **before** the synth. Since the settings have been
|
| 6 | |
created first to initialize the synth, you must first delete the synth
|
| 7 | |
and then delete the settings. This currently crashes all applications
|
| 8 | |
that use fluidsynth 2.1.6 and SDL2_mixer. Please apply the attached
|
| 9 | |
patch and release a bug fix release.
|
| 10 | |
|
| 11 | |
Originally reported at https://github.com/FluidSynth/fluidsynth/issues/748
|
| 12 | |
|
| 13 | |
Co-authored-by: Tom M.
|
| 14 | |
Origin: upstream, 2.0.6, commit:https://github.com/libsdl-org/SDL_mixer/commit/6160668079f91d57a5d7bf0b40ffdd843be70daf
|
| 15 | |
---
|
| 16 | |
music_fluidsynth.c | 3 ++-
|
| 17 | |
1 file changed, 2 insertions(+), 1 deletion(-)
|
| 18 | |
|
| 19 | |
diff --git a/music_fluidsynth.c b/music_fluidsynth.c
|
| 20 | |
index f5346a4..e72e2ca 100644
|
| 21 | |
--- a/music_fluidsynth.c
|
| 22 | |
+++ b/music_fluidsynth.c
|
| 23 | |
@@ -273,9 +273,10 @@ static void FLUIDSYNTH_Stop(void *context)
|
| 24 | |
static void FLUIDSYNTH_Delete(void *context)
|
| 25 | |
{
|
| 26 | |
FLUIDSYNTH_Music *music = (FLUIDSYNTH_Music *)context;
|
| 27 | |
+ fluid_settings_t *settings = fluidsynth.fluid_synth_get_settings(music->synth);
|
| 28 | |
fluidsynth.delete_fluid_player(music->player);
|
| 29 | |
- fluidsynth.delete_fluid_settings(fluidsynth.fluid_synth_get_settings(music->synth));
|
| 30 | |
fluidsynth.delete_fluid_synth(music->synth);
|
| 31 | |
+ fluidsynth.delete_fluid_settings(settings);
|
| 32 | |
SDL_free(music);
|
| 33 | |
}
|
| 34 | |
|