Ze Sheng

A flaw in the TTL file parser can lead to an infinite loop, resulting in a denial of service.

A double-free issue exists in the `parse def()` function within `src/conf.c`. This occurs when the system parses nested compound or array configuration blocks and fails to check return values before proceeding. Consequently, the `snd config delete()` function is called twice on the same already-freed node, which can lead to memory corruption, a NULL-pointer write, or an invalid memory read if an attacker provides maliciously crafted ALSA configuration text.

An out-of-memory issue exists in the `rust demangle()` function, which allocates unbounded output buffers without size limits. This allows attackers to craft malicious Rust symbol names within binaries to trigger exponential memory allocation, leading to process crashes during binary analysis.