Changeset 57054 in vbox

Timestamp:

Jul 22, 2015 11:38:49 AM (10 years ago)

Author:

vboxsync

Message:

Devices/Audio/DrvAudio.cpp: Fix cleanup logic, as having it in the destruct callback is too late (it uses the driver below, which is already destructed at this point). Kind of a use after free, but for VM poweroff the memory is freed later (it crashed when constructing failed as then the driver below is freed before destructing this one).

File:

• trunk/src/VBox/Devices/Audio/DrvAudio.cpp (modified) (2 diffs)

trunk/src/VBox/Devices/Audio/DrvAudio.cpp

@@ -1761 +1761 @@
 static DECLCALLBACK(void) drvAudioPowerOff(PPDMDRVINS pDrvIns)
 {
-    drvAudioStateHandler(pDrvIns, PDMAUDIOSTREAMCMD_DISABLE);
-}
-
-/**
- * Destructs an audio driver instance.
- *
- * Most VM resources are freed by the VM. This callback is provided so that any non-VM
- * resources can be freed correctly.
- *
- * @param   pDrvIns     The driver instance data.
- */
-static DECLCALLBACK(void) drvAudioDestruct(PPDMDRVINS pDrvIns)
-{
     LogFlowFuncEnter();
     PDMDRV_CHECK_VERSIONS_RETURN_VOID(pDrvIns);
 
     PDRVAUDIO pThis = PDMINS_2_DATA(pDrvIns, PDRVAUDIO);
+
+    if (!pThis->pHostDrvAudio)
+        return;
 
     /* Tear down all host output streams. */
@@ -1917 +1907 @@
     drvAudioConstruct,
     /* pfnDestruct */
-    drvAudioDestruct,
+    NULL,
     /* pfnRelocate */
     NULL,