elfutils/libelf-Fix-double-free-in-__libelf_compress-on-error.patch

46 lines
1.5 KiB
Diff

From a5d73b3e51afada171da9781089cd0e8fc9f64a6 Mon Sep 17 00:00:00 2001
From: Mark Wielaard <mark@klomp.org>
Date: Sat, 25 Apr 2020 01:21:12 +0200
Subject: [PATCH 1/5] libelf: Fix double free in __libelf_compress on error
path.
In commit 2092865a7e589ff805caa47e69ac9630f34d4f2a
"libelf: {de,}compress: ensure zlib resource cleanup" we added a
call to deflate_cleanup to make sure all resources were freed.
As GCC10 -fanalyzer points out that could cause a double free
of out_buf. Fix by removing the free (out_buf) in __libelf_compress.
Signed-off-by: Mark Wielaard <mark@klomp.org>
---
libelf/ChangeLog | 4 ++++
libelf/elf_compress.c | 1 -
2 files changed, 4 insertions(+), 1 deletion(-)
diff --git a/libelf/ChangeLog b/libelf/ChangeLog
index 8f79a62..56f5354 100644
--- a/libelf/ChangeLog
+++ b/libelf/ChangeLog
@@ -1,3 +1,7 @@
+2020-04-25 Mark Wielaard <mark@klomp.org>
+
+ * elf_compress.c (__libelf_compress): Remove free (out_buf).
+
2020-03-18 Omar Sandoval <osandov@fb.com>
* elf_getphdrnum.c (__elf_getphdrnum_rdlock): Call
diff --git a/libelf/elf_compress.c b/libelf/elf_compress.c
index b1b8968..e5d3d2e 100644
--- a/libelf/elf_compress.c
+++ b/libelf/elf_compress.c
@@ -113,7 +113,6 @@ __libelf_compress (Elf_Scn *scn, size_t hsize, int ei_data,
int zrc = deflateInit (&z, Z_BEST_COMPRESSION);
if (zrc != Z_OK)
{
- free (out_buf);
__libelf_seterrno (ELF_E_COMPRESS_ERROR);
return deflate_cleanup(NULL, NULL);
}
--
1.8.3.1