ucm: uc_mgr_substitute_tree() fix use after free

Signed-off-by: Jaroslav Kysela <perex@perex.cz>

diff --git a/src/ucm/ucm_subs.c b/src/ucm/ucm_subs.c
index f608bb0..df6d736 100644 (file)
--- a/src/ucm/ucm_subs.c
+++ b/src/ucm/ucm_subs.c
@@ -417,11 +417,12 @@ int uc_mgr_substitute_tree(snd_use_case_mgr_t *uc_mgr, snd_config_t *node)
                if (err < 0)
                        return err;
                err = snd_config_set_id(node, s);
-               free(s);
                if (err < 0) {
                        uc_error("unable to set substituted id '%s' (old id '%s')", s, id);
+                       free(s);
                        return err;
                }
+               free(s);
        }
        if (snd_config_get_type(node) != SND_CONFIG_TYPE_COMPOUND) {
                if (snd_config_get_type(node) == SND_CONFIG_TYPE_STRING) {