Re: Security: double-free / invalid pointer dereference in alsa-lib config parser (`parse_def`) via crafted configuration text

Hi Jaroslav,

Great, thanks for the quick fix. Are you generating CVEs for this issue?

Best

Luigino

On Mon, Jun 8, 2026 at 2:50 PM Jaroslav Kysela <[email protected]> wrote:

> On 6/8/26 12:05, Luigino Camastra wrote:
> > Dear ALSA maintainers,
> >
> > I am writing to report a memory-safety issue in **alsa-lib**'s
> > configuration parser (`src/conf.c`). The bug was found by fuzzing the
> > public API `snd_config_load_string()`, and is reachable from any
> > application that loads attacker-influenced ALSA configuration text or
> files
> > (`snd_config_load`, `snd_config_load_string`, `snd_config_update`,
> > `~/.asoundrc`, etc.).
> >
> > ## Summary
> >
> > When parsing a nested compound (`{ … }`) or array (`[ … ]`),
> `parse_def()`
> > calls `parse_defs()` / `parse_array_defs()` but **does not check their
> > return value before continuing**. On a parse error from the nested call,
> > the inner level has already deleted (and unlinked) its node via
> > `snd_config_delete(n)`; `parse_def()` then falls through and calls
> > `snd_config_delete(n)` again on an already-freed / unlinked node during
> > error cleanup. This corrupts the configuration node list and leads to a
> > **double free / invalid pointer dereference**.
>
> Thank you for this report. I've fixed this issue in commit 536dd6f8
> ("conf:
> add missing return value check in parse_def()") .
>
>                                 Jaroslav
>
> --
> Jaroslav Kysela <[email protected]>
> Linux Sound Maintainer; ALSA Project; Red Hat, Inc.
>