From 1153507216b787ffe974d6661cd0c58118c96974 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Robert=20M=C3=BCller?= Date: Thu, 25 Apr 2024 20:03:38 +0200 Subject: [PATCH] Fix double-free when reading opus file fails Set the data pointer of the sample only when the sample has been loaded successfully, so the invalid sample data is not freed again when decoding fails. --- src/engine/client/sound.cpp | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/src/engine/client/sound.cpp b/src/engine/client/sound.cpp index 2b4f3ce63..4aa8b38ba 100644 --- a/src/engine/client/sound.cpp +++ b/src/engine/client/sound.cpp @@ -355,15 +355,15 @@ bool CSound::DecodeOpus(CSample &Sample, const void *pData, unsigned DataSize) c return false; } - Sample.m_pData = (short *)calloc((size_t)NumSamples * NumChannels, sizeof(short)); + short *pSampleData = (short *)calloc((size_t)NumSamples * NumChannels, sizeof(short)); int Pos = 0; while(Pos < NumSamples) { - const int Read = op_read(pOpusFile, Sample.m_pData + Pos * NumChannels, NumSamples * NumChannels, nullptr); + const int Read = op_read(pOpusFile, pSampleData + Pos * NumChannels, NumSamples * NumChannels, nullptr); if(Read < 0) { - free(Sample.m_pData); + free(pSampleData); dbg_msg("sound/opus", "op_read error %d at %d", Read, Pos); return false; } @@ -372,6 +372,7 @@ bool CSound::DecodeOpus(CSample &Sample, const void *pData, unsigned DataSize) c Pos += Read; } + Sample.m_pData = pSampleData; Sample.m_NumFrames = Pos; Sample.m_Rate = 48000; Sample.m_LoopStart = -1;