From f1390780ca8561b701222f2748000d8f80bbe99b Mon Sep 17 00:00:00 2001
From: Mathieu Eyraud <[EMAIL REDACTED]>
Date: Tue, 2 Aug 2022 15:25:44 +0200
Subject: [PATCH] Fix use after free when removing Windows audio device
---
src/audio/wasapi/SDL_wasapi_winrt.cpp | 3 ++-
src/core/windows/SDL_immdevice.c | 3 ++-
2 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/src/audio/wasapi/SDL_wasapi_winrt.cpp b/src/audio/wasapi/SDL_wasapi_winrt.cpp
index a4796f31b3d..235ae7d32eb 100644
--- a/src/audio/wasapi/SDL_wasapi_winrt.cpp
+++ b/src/audio/wasapi/SDL_wasapi_winrt.cpp
@@ -396,8 +396,9 @@ WASAPI_RemoveDevice(const SDL_bool iscapture, LPCWSTR devid)
SDL_RemoveAudioDevice(iscapture, i->str);
SDL_free(i->str);
SDL_free(i);
+ } else {
+ prev = i;
}
- prev = i;
}
}
diff --git a/src/core/windows/SDL_immdevice.c b/src/core/windows/SDL_immdevice.c
index 01658db8b1a..0a00a6d0296 100644
--- a/src/core/windows/SDL_immdevice.c
+++ b/src/core/windows/SDL_immdevice.c
@@ -108,8 +108,9 @@ SDL_IMMDevice_Remove(const SDL_bool iscapture, LPCWSTR devid, SDL_bool useguid)
SDL_RemoveAudioDevice(iscapture, useguid ? ((void *) i->guid) : ((void *) i->str));
SDL_free(i->str);
SDL_free(i);
+ } else {
+ prev = i;
}
- prev = i;
}
}