$OpenBSD: patch-src_core_c,v 1.3 2015/07/26 05:49:37 jeremy Exp $

Fix use-after-free when sample rate switches. This isn't a perfect fix,
as it does result in some uninitialized memory be used (displayed for
a split second if the sample rate switches), but it's better than
crashing.

--- src/core.c.orig	Tue Jun  3 08:08:19 2014
+++ src/core.c	Fri Jul 17 23:54:46 2015
@@ -372,7 +372,8 @@ disk_thread(void * arg) {
 					    (fdec->pdec != NULL)) {
 
 						decoder_t * dec = (decoder_t *)fdec->pdec;
-						
+						fileinfo_t fileinfo_sent;
+
 						cdda_decoder_reopen(dec, filename);
 						fdec->samples_left = fdec->fileinfo.total_samples;
 
@@ -382,9 +383,11 @@ disk_thread(void * arg) {
 						sample_offset = 0;
 
 						send_cmd = CMD_FILEINFO;
+						fileinfo_sent = fdec->fileinfo;
+						fileinfo_sent.format_str = strdup(fdec->fileinfo.format_str);
 						rb_write(rb_disk2gui, &send_cmd,
 								      sizeof(send_cmd));
-						rb_write(rb_disk2gui, (char *)&(fdec->fileinfo),
+						rb_write(rb_disk2gui, (char *)&fileinfo_sent,
 							              sizeof(fileinfo_t));
 
 						info->is_streaming = 1;
@@ -411,6 +414,8 @@ disk_thread(void * arg) {
 						rb_write(rb_disk2gui, &send_cmd, 1);
 						goto sleep;
 					} else {
+						fileinfo_t fileinfo_sent;
+
 						file_decoder_set_rva(fdec, cue.voladj);
 						info->in_SR_prev = info->in_SR;
 						info->in_SR = fdec->fileinfo.sample_rate;
@@ -430,9 +435,11 @@ disk_thread(void * arg) {
 						sample_offset = 0;
 
 						send_cmd = CMD_FILEINFO;
+						fileinfo_sent = fdec->fileinfo;
+						fileinfo_sent.format_str = strdup(fdec->fileinfo.format_str);
 						rb_write(rb_disk2gui, &send_cmd,
 								      sizeof(send_cmd));
-						rb_write(rb_disk2gui, (char *)&(fdec->fileinfo),
+						rb_write(rb_disk2gui, (char *)&fileinfo_sent,
 								      sizeof(fileinfo_t));
 
 						info->is_streaming = 1;
