Plug some memory leaks and an invalid read

Note in protocol-dbus.c specifically, method_signatures needs to be freed
before method_handlers, because otherwise h->method_name is freed while it is
still in use as a key in the method_signatures hashmap.

diff --git a/src/modules/dbus/module-dbus-protocol.c b/src/modules/dbus/module-dbus-protocol.c
index 4969585fc06d3dcd44e6eac7c1657cc473a42d38..ae9df204580563e6ede407804a9d13ede0af4bed 100644 (file)
--- a/src/modules/dbus/module-dbus-protocol.c
+++ b/src/modules/dbus/module-dbus-protocol.c
@@ -569,6 +569,8 @@ int pa__init(pa_module *m) {
     u->dbus_protocol = pa_dbus_protocol_get(m->core);
     u->core_iface = pa_dbusiface_core_new(m->core);
 
+    pa_modargs_free(ma);
+
     return 0;
 
 fail:

diff --git a/src/modules/module-card-restore.c b/src/modules/module-card-restore.c
index fc5df5f6c5d1a4cffc9a5f745c8cd5b543d5e991..f987f19ad23b3dfbe144df90c7e5a7d4a32c53f8 100644 (file)
--- a/src/modules/module-card-restore.c
+++ b/src/modules/module-card-restore.c
@@ -246,14 +246,13 @@ static void subscribe_callback(pa_core *c, pa_subscription_event_type_t t, uint3
         t != (PA_SUBSCRIPTION_EVENT_CARD|PA_SUBSCRIPTION_EVENT_CHANGE))
         return;
 
-    entry = entry_new();
-
     if (!(card = pa_idxset_get_by_index(c->cards, idx)))
         return;
 
     if (!card->save_profile)
         return;
 
+    entry = entry_new();
     entry->profile = pa_xstrdup(card->active_profile ? card->active_profile->name : "");
 
     if ((old = entry_read(u, card->name))) {

diff --git a/src/modules/module-stream-restore.c b/src/modules/module-stream-restore.c
index 7bb30934b557527b0182beaace976b79aa8a809d..506c5fca05d515df4f39057c6d9758fe75cf53e6 100644 (file)
--- a/src/modules/module-stream-restore.c
+++ b/src/modules/module-stream-restore.c
@@ -328,6 +328,7 @@ static void dbus_entry_free(struct dbus_entry *de) {
 
     pa_xfree(de->entry_name);
     pa_xfree(de->object_path);
+    pa_xfree(de);
 }
 
 /* Reads an array [(UInt32, UInt32)] from the iterator. The struct items are

diff --git a/src/pulsecore/flist.c b/src/pulsecore/flist.c
index add3aa20ea43cee3b202c0a8b0780c1a4696e037..acdeff38451405680b353e1bbed72250f4d58629 100644 (file)
--- a/src/pulsecore/flist.c
+++ b/src/pulsecore/flist.c
@@ -113,6 +113,7 @@ void pa_flist_free(pa_flist *l, pa_free_cb_t free_cb) {
             free_cb(pa_atomic_ptr_load(&elem->ptr));
     }
 
+    pa_xfree((char *) l->name);
     pa_xfree(l);
 }
 

diff --git a/src/pulsecore/protocol-dbus.c b/src/pulsecore/protocol-dbus.c
index 8784c34526ea6b9dee837c954572b2db46ab1d4e..4d60c92e62da7ed170be5230f6f04c0e8dc70199 100644 (file)
--- a/src/pulsecore/protocol-dbus.c
+++ b/src/pulsecore/protocol-dbus.c
@@ -839,8 +839,8 @@ int pa_dbus_protocol_remove_interface(pa_dbus_protocol *p, const char* path, con
     pa_log_debug("Interface %s removed from object %s", iface_entry->name, obj_entry->path);
 
     pa_xfree(iface_entry->name);
-    pa_hashmap_free(iface_entry->method_handlers, method_handler_free_cb, NULL);
     pa_hashmap_free(iface_entry->method_signatures, method_signature_free_cb, NULL);
+    pa_hashmap_free(iface_entry->method_handlers, method_handler_free_cb, NULL);
     pa_hashmap_free(iface_entry->property_handlers, property_handler_free_cb, NULL);
 
     for (i = 0; i < iface_entry->n_signals; ++i) {