tone-player: Fix asan defect (stack-buffer-underflow)

==pulseaudio==799==ERROR: AddressSanitizer: stack-buffer-underflow on address 0xbdc65da0 at pc 0xb5c397ad bp 0xbdc60db0 sp 0xbdc60e00
READ of size 22 at 0xbdc65da0 thread T0
    #0 0xb5c397aa in printf_common(void*, char const*, std::__va_list) (/usr/lib/libasan.so+0x757aa)
    #1 0xb5c3b11c in vsnprintf (/usr/lib/libasan.so+0x7711c)
    #2 0xb58ca3ba in pa_vsnprintf (/usr/lib/pulseaudio/libpulsecommon-13.0.so+0x4a3ba)
    #3 0xb58ddcd8 in pa_log_levelv_meta (/usr/lib/pulseaudio/libpulsecommon-13.0.so+0x5dcd8)
    #4 0xb58dd5c6 in pa_log_level_meta (/usr/lib/pulseaudio/libpulsecommon-13.0.so+0x5d5c6)
    #5 0xb2e262d8 in module_tone_player_LTX_pa__init (/usr/lib/pulse-13.0/modules/module-tone-player.so+0x22d8)
    #6 0xb5ab7072 in pa_module_load (/usr/lib/pulseaudio/libpulsecore-13.0.so+0x56072)
    #7 0xb5a9818e in pa_cli_command_load (/usr/lib/pulseaudio/libpulsecore-13.0.so+0x3718e)
    #8 0xb5aa06b2 in pa_cli_command_execute_line_stateful (/usr/lib/pulseaudio/libpulsecore-13.0.so+0x3f6b2)
    #9 0xb5aa11c4 in pa_cli_command_execute_file_stream (/usr/lib/pulseaudio/libpulsecore-13.0.so+0x401c4)
    #10 0x1810a in main (/usr/bin/pulseaudio+0x1810a)
    #11 0xb5440c80 in __libc_start_main (/lib/libc.so.6+0x1ac80)

[Version] 13.0.41
[Issue Type] Bug

Change-Id: Ib0c1987d14ac42d47b7e6036b12c1313b275b151

diff --git a/packaging/pulseaudio-modules-tizen.spec b/packaging/pulseaudio-modules-tizen.spec
index 2eb1819..bddc754 100644 (file)
--- a/packaging/pulseaudio-modules-tizen.spec
+++ b/packaging/pulseaudio-modules-tizen.spec
@@ -1,6 +1,6 @@
 Name:             pulseaudio-modules-tizen
 Summary:          Pulseaudio modules for Tizen
-Version:          13.0.40
+Version:          13.0.41
 Release:          0
 Group:            Multimedia/Audio
 License:          LGPL-2.1+

diff --git a/src/module-tone-player.c b/src/module-tone-player.c
index de3d2f6..0e506c3 100644 (file)
--- a/src/module-tone-player.c
+++ b/src/module-tone-player.c
@@ -494,13 +494,18 @@ int pa__init(pa_module *m) {
     m->userdata = u = pa_xnew0(struct userdata, 1);
     u->module = m;
 
+    dbus_error_init(&err);
+
     if (!(conn = pa_dbus_bus_get(u->module->core, DBUS_BUS_SYSTEM, &err)) || dbus_error_is_set(&err)) {
         if (conn)
             pa_dbus_connection_unref(conn);
 
         pa_log_error("Unable to contact D-Bus system bus: %s: %s", err.name, err.message);
-    } else
-        pa_log_debug("Got dbus connection");
+
+        pa_xfree(u);
+        return -1;
+    }
+    pa_log_debug("Got dbus connection");
 
     u->dbus_conn = conn;
     pa_assert_se(dbus_connection_register_object_path(pa_dbus_connection_get(conn),