From b430407f47fac227b4a6952ab502705d83ff90f5 Mon Sep 17 00:00:00 2001
From: Maarten Bosmans <mkbosmans@gmail.com>
Date: Fri, 12 Aug 2011 00:17:39 +0200
Subject: [PATCH] Plug some memory leaks and an invalid read

Note in protocol-dbus.c specifically, method_signatures needs to be freed
before method_handlers, because otherwise h->method_name is freed while it is
still in use as a key in the method_signatures hashmap.
---
 src/modules/dbus/module-dbus-protocol.c | 2 ++
 src/modules/module-card-restore.c       | 3 +--
 src/modules/module-stream-restore.c     | 1 +
 src/pulsecore/flist.c                   | 1 +
 src/pulsecore/protocol-dbus.c           | 2 +-
 5 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/src/modules/dbus/module-dbus-protocol.c b/src/modules/dbus/module-dbus-protocol.c
index 4969585..ae9df20 100644
--- a/src/modules/dbus/module-dbus-protocol.c
+++ b/src/modules/dbus/module-dbus-protocol.c
@@ -569,6 +569,8 @@ int pa__init(pa_module *m) {
     u->dbus_protocol = pa_dbus_protocol_get(m->core);
     u->core_iface = pa_dbusiface_core_new(m->core);
 
+    pa_modargs_free(ma);
+
     return 0;
 
 fail:
diff --git a/src/modules/module-card-restore.c b/src/modules/module-card-restore.c
index fc5df5f..f987f19 100644
--- a/src/modules/module-card-restore.c
+++ b/src/modules/module-card-restore.c
@@ -246,14 +246,13 @@ static void subscribe_callback(pa_core *c, pa_subscription_event_type_t t, uint3
         t != (PA_SUBSCRIPTION_EVENT_CARD|PA_SUBSCRIPTION_EVENT_CHANGE))
         return;
 
-    entry = entry_new();
-
     if (!(card = pa_idxset_get_by_index(c->cards, idx)))
         return;
 
     if (!card->save_profile)
         return;
 
+    entry = entry_new();
     entry->profile = pa_xstrdup(card->active_profile ? card->active_profile->name : "");
 
     if ((old = entry_read(u, card->name))) {
diff --git a/src/modules/module-stream-restore.c b/src/modules/module-stream-restore.c
index 7bb3093..506c5fc 100644
--- a/src/modules/module-stream-restore.c
+++ b/src/modules/module-stream-restore.c
@@ -328,6 +328,7 @@ static void dbus_entry_free(struct dbus_entry *de) {
 
     pa_xfree(de->entry_name);
     pa_xfree(de->object_path);
+    pa_xfree(de);
 }
 
 /* Reads an array [(UInt32, UInt32)] from the iterator. The struct items are
diff --git a/src/pulsecore/flist.c b/src/pulsecore/flist.c
index add3aa2..acdeff3 100644
--- a/src/pulsecore/flist.c
+++ b/src/pulsecore/flist.c
@@ -113,6 +113,7 @@ void pa_flist_free(pa_flist *l, pa_free_cb_t free_cb) {
             free_cb(pa_atomic_ptr_load(&elem->ptr));
     }
 
+    pa_xfree((char *) l->name);
     pa_xfree(l);
 }
 
diff --git a/src/pulsecore/protocol-dbus.c b/src/pulsecore/protocol-dbus.c
index 8784c34..4d60c92 100644
--- a/src/pulsecore/protocol-dbus.c
+++ b/src/pulsecore/protocol-dbus.c
@@ -839,8 +839,8 @@ int pa_dbus_protocol_remove_interface(pa_dbus_protocol *p, const char* path, con
     pa_log_debug("Interface %s removed from object %s", iface_entry->name, obj_entry->path);
 
     pa_xfree(iface_entry->name);
-    pa_hashmap_free(iface_entry->method_handlers, method_handler_free_cb, NULL);
     pa_hashmap_free(iface_entry->method_signatures, method_signature_free_cb, NULL);
+    pa_hashmap_free(iface_entry->method_handlers, method_handler_free_cb, NULL);
     pa_hashmap_free(iface_entry->property_handlers, property_handler_free_cb, NULL);
 
     for (i = 0; i < iface_entry->n_signals; ++i) {
-- 
2.7.4