Re: Security: double-free / invalid pointer dereference in alsa-lib config parser (`parse_def`) via crafted configuration text

On 6/8/26 12:05, Luigino Camastra wrote:
> Dear ALSA maintainers,
> 
> I am writing to report a memory-safety issue in **alsa-lib**'s
> configuration parser (`src/conf.c`). The bug was found by fuzzing the
> public API `snd_config_load_string()`, and is reachable from any
> application that loads attacker-influenced ALSA configuration text or files
> (`snd_config_load`, `snd_config_load_string`, `snd_config_update`,
> `~/.asoundrc`, etc.).
> 
> ## Summary
> 
> When parsing a nested compound (`{ … }`) or array (`[ … ]`), `parse_def()`
> calls `parse_defs()` / `parse_array_defs()` but **does not check their
> return value before continuing**. On a parse error from the nested call,
> the inner level has already deleted (and unlinked) its node via
> `snd_config_delete(n)`; `parse_def()` then falls through and calls
> `snd_config_delete(n)` again on an already-freed / unlinked node during
> error cleanup. This corrupts the configuration node list and leads to a
> **double free / invalid pointer dereference**.

Thank you for this report. I've fixed this issue in commit 536dd6f8 ("conf: 
add missing return value check in parse_def()") .

				Jaroslav

-- 
Jaroslav Kysela <[email protected]>
Linux Sound Maintainer; ALSA Project; Red Hat, Inc.