Package list libsdl2-mixer / 331ca84
Fixed use-after-free in music_fluidsynth.c Backport a patch from upstream that fixes a use-after-free in music_fluidsynth.c, which would cause a segmentation fault with libfluidsynth 2.1.6 whenever a song was stopped. Fabian Greffrath 6 months ago
2 changed file(s) with 29 addition(s) and 0 deletion(s). Raw diff Collapse all Expand all
0 From 6160668079f91d57a5d7bf0b40ffdd843be70daf Mon Sep 17 00:00:00 2001
1 From: Sam Lantinga <slouken@libsdl.org>
2 Date: Wed, 20 Jan 2021 10:17:10 -0800
3 Subject: [PATCH 199/199] Fixed use-after-free in music_fluidsynth.c
4
5 Tom M.
6
7 There is a dangerous use-after-free in FLUIDSYNTH_Delete(): the settings object is deleted **before** the synth. Since the settings have been created first to initialize the synth, you must first delete the synth and then delete the settings. This currently crashes all applications that use fluidsynth 2.1.6 and SDL2_mixer. Please apply the attached patch and release a bug fix release.
8
9 Originally reported at https://github.com/FluidSynth/fluidsynth/issues/748
10 ---
11 src/codecs/music_fluidsynth.c | 3 ++-
12 1 file changed, 2 insertions(+), 1 deletion(-)
13
14 --- a/music_fluidsynth.c
15 +++ b/music_fluidsynth.c
16 @@ -273,9 +273,10 @@ static void FLUIDSYNTH_Stop(void *contex
17 static void FLUIDSYNTH_Delete(void *context)
18 {
19 FLUIDSYNTH_Music *music = (FLUIDSYNTH_Music *)context;
20 + fluid_settings_t *settings = fluidsynth.fluid_synth_get_settings(music->synth);
21 fluidsynth.delete_fluid_player(music->player);
22 - fluidsynth.delete_fluid_settings(fluidsynth.fluid_synth_get_settings(music->synth));
23 fluidsynth.delete_fluid_synth(music->synth);
24 + fluidsynth.delete_fluid_settings(settings);
25 SDL_free(music);
26 }
27
0 0199-Fixed-use-after-free-in-music_fluidsynth.c.patch