services/pipewire: destroy bound audio object when node is destroyed

outfoxxed · outfoxxed · commit 87d99b866f98 · 2025-07-04T20:29:50.000-07:00
Fixes a leak and prevents a UAF via device volume signals derefing the freed node. Fixes #91
diff --git a/src/services/pipewire/node.cpp b/src/services/pipewire/node.cpp
@@ -252,7 +252,7 @@ void PwNode::onParam(
 	}
 }
 
-PwNodeBoundAudio::PwNodeBoundAudio(PwNode* node): node(node) {
+PwNodeBoundAudio::PwNodeBoundAudio(PwNode* node): QObject(node), node(node) {
 	if (node->device) {
 		QObject::connect(node->device, &PwDevice::deviceReady, this, &PwNodeBoundAudio::onDeviceReady);
 

Original file line number	Diff line number	Diff line change
`@@ -252,7 +252,7 @@ void PwNode::onParam(`
`252`	`252`	`}`
`253`	`253`	`}`
`254`	`254`
`255`		`-PwNodeBoundAudio::PwNodeBoundAudio(PwNode* node): node(node) {`
	`255`	`+PwNodeBoundAudio::PwNodeBoundAudio(PwNode* node): QObject(node), node(node) {`
`256`	`256`	`if (node->device) {`
`257`	`257`	`QObject::connect(node->device, &PwDevice::deviceReady, this, &PwNodeBoundAudio::onDeviceReady);`
`258`	`258`