From 8a15575c92f882b4f6bf29ec94e7bf40689a143b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Barnab=C3=A1s=20P=C5=91cze?= Date: Sat, 25 Jul 2026 02:12:19 +0200 Subject: [PATCH] linux-pipewire: Fix use-after-free in log message When a device disappears, it is removed from the hash table and a message is logged. However, this log message uses the device's id, which is freed when it is removed from the hash table. So swap the order to fix that. --- plugins/linux-pipewire/camera-portal.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/plugins/linux-pipewire/camera-portal.c b/plugins/linux-pipewire/camera-portal.c index 794f849e3cc4c0..8d53b7f743d977 100644 --- a/plugins/linux-pipewire/camera-portal.c +++ b/plugins/linux-pipewire/camera-portal.c @@ -1029,8 +1029,8 @@ static void on_registry_global_remove_cb(void *user_data, uint32_t id) while (g_hash_table_iter_next(&iter, (gpointer *)&device_id, (gpointer *)&device)) { if (device->id != id) continue; - g_hash_table_iter_remove(&iter); blog(LOG_INFO, "[pipewire-camera] Removed device %s", device_id); + g_hash_table_iter_remove(&iter); } for (size_t i = 0; i < connection->sources->len; i++) { struct camera_portal_source *camera_source = g_ptr_array_index(connection->sources, i);