Skip to content

Commit

Permalink
Merge pull request Rust-SDL2#1012 from GautierMinster/audio/audio_dev…
Browse files Browse the repository at this point in the history
…ice_name_open_use_after_free

audio: fix device name use-after-free in AudioDevice::open
  • Loading branch information
Cobrand authored Jun 24, 2020
2 parents 9992aec + 1ba7ea7 commit b22de9d
Showing 1 changed file with 8 additions and 2 deletions.
10 changes: 8 additions & 2 deletions src/sdl2/audio.rs
Original file line number Diff line number Diff line change
Expand Up @@ -559,7 +559,10 @@ impl<'a, Channel: AudioFormatNum> AudioQueue<Channel> {
Some(device) => Some(CString::new(device).unwrap()),
None => None
};
let device_ptr = device.map_or(ptr::null(), |s| s.as_ptr());
// Warning: map_or consumes its argument; `device.map_or()` would therefore consume the
// CString and drop it, making device_ptr a dangling pointer! To avoid that we downgrade
// device to an Option<&_> first.
let device_ptr = device.as_ref().map_or(ptr::null(), |s| s.as_ptr());

let iscapture_flag = 0;
let device_id = sys::SDL_OpenAudioDevice(
Expand Down Expand Up @@ -652,7 +655,10 @@ impl<CB: AudioCallback> AudioDevice<CB> {
Some(device) => Some(CString::new(device).unwrap()),
None => None
};
let device_ptr = device.map_or(ptr::null(), |s| s.as_ptr());
// Warning: map_or consumes its argument; `device.map_or()` would therefore consume the
// CString and drop it, making device_ptr a dangling pointer! To avoid that we downgrade
// device to an Option<&_> first.
let device_ptr = device.as_ref().map_or(ptr::null(), |s| s.as_ptr());

let iscapture_flag = if capture { 1 } else { 0 };
let device_id = sys::SDL_OpenAudioDevice(
Expand Down

0 comments on commit b22de9d

Please sign in to comment.