From a471827d1f949f1da68500c03f5a2328e3a483d0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fr=C3=A9d=C3=A9ric=20Dalleau?= Date: Mon, 22 Aug 2011 17:30:39 +0200 Subject: [PATCH] Fix double free in error case in endpoint_reply If SetConfiguration call fails, the headset or gateway for which SetConfiguration is called is disconnected. This will free any pending request, but this does not prevent the request to terminate (endpoint_reply) and try to free itself once again. Note that a copy of the freed pointer is tested which has not been updated. --- audio/media.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/audio/media.c b/audio/media.c index 42d8637b4..2076d04b7 100644 --- a/audio/media.c +++ b/audio/media.c @@ -264,7 +264,8 @@ done: if (request->cb) request->cb(endpoint, ret, size, request->user_data); - endpoint_request_free(request); + if (endpoint->request) + endpoint_request_free(endpoint->request); endpoint->request = NULL; } -- 2.47.3