[PATCH 0/1] MR9019: libs/fluidsynth: Fix memory leak / use-after-free crash due to incorrect refcounting

[Jinoh Kang (＠iamahuman)]

FluidSynth settings table is internally a refcounted hashtable.

Due to wrong glib atomic emulation, the hashtable might be leaked (if refcount != 2) or abruptly freed (if refcount == 2) due to incorrect return value from `fluid_atomic_int_exchange_and_add()`.

[PATCH 1/1] libs/fluidsynth: Fix g_atomic_int_add() return value.

[Jinoh Kang]

From: Jinoh Kang

FluidSynth settings table is internally a refcounted hashtable.

Due to wrong glib atomic emulation, the hashtable might be leaked (if refcount != 2) or abruptly freed (if refcount == 2) due to incorrect return value from `fluid_atomic_int_exchange_and_add()`.

Fixes: f768d6b31bebc35fbaf751d0cd57c8bd302a8d60
---
 libs/fluidsynth/glib.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libs/fluidsynth/glib.h b/libs/fluidsynth/glib.h
index 6bbd5acc75e..a2cfd2c743d 100644
--- a/libs/fluidsynth/glib.h
+++ b/libs/fluidsynth/glib.h
@@ -100,7 +100,7 @@ static inline void g_cond_broadcast( GCond *cond ) { WakeAllConditionVariable( c
 static inline void g_cond_wait( GCond *cond, GMutex *mutex ) { SleepConditionVariableSRW( cond, mutex, INFINITE, 0 ); }

static inline void g_atomic_int_inc( int *ptr ) { InterlockedIncrement( (LONG *)ptr ); }
-static inline int g_atomic_int_add( int *ptr, int val ) { return InterlockedAdd( (LONG *)ptr, val ) - 1; }
+static inline int g_atomic_int_add( int *ptr, int val ) { return InterlockedAdd( (LONG *)ptr, val ) - val; }
 static inline int g_atomic_int_get( int *ptr ) { return ReadAcquire( (LONG *)ptr ); }
 static inline void g_atomic_int_set( int *ptr, int val ) { InterlockedExchange( (LONG *)ptr, val ); }
 static inline int g_atomic_int_dec_and_test( int *ptr, int val ) { return !InterlockedAdd( (LONG *)ptr, -val ); }

[PATCH 0/1] MR9019: libs/fluidsynth: Fix memory leak / use-after-free crash due to incorrect refcounting - approved

[Huw Davies (＠huw)]

This merge request was approved by Huw Davies.

[PATCH 0/1] MR9019: libs/fluidsynth: Fix memory leak / use-after-free crash due to incorrect refcounting - approved

[Rémi Bernon (＠rbernon)]

This merge request was approved by Rémi Bernon.