-
由 Jiri Slaby 提交于
Stanse found that in snd_usb_parse_audio_endpoints, there is a dangling pointer dereference. When snd_usb_parse_audio_format fails, fp is freed, and continue invoked. On the next loop, there is "fp && fp->altsetting == 1 && fp->channels == 1" test, but fp is set from the last iteration (but is bogus) and thus ilegally dereferenced. Set fp to NULL before "continue". Signed-off-by: NJiri Slaby <jslaby@suse.cz> Acked-by: NDaniel Mack <daniel@caiaq.de> Signed-off-by: NTakashi Iwai <tiwai@suse.de>
272cbc98