From 0b2fc95c46dabf85d053b2f0c6aab217b9c5a9b8 Mon Sep 17 00:00:00 2001 From: Mark Wielaard Date: Sat, 25 Apr 2020 01:21:12 +0200 Subject: [PATCH] libelf: Fix double free in __libelf_compress on error path. In commit 2092865a7e589ff805caa47e69ac9630f34d4f2a "libelf: {de,}compress: ensure zlib resource cleanup" we added a call to deflate_cleanup to make sure all resources were freed. As GCC10 -fanalyzer points out that could cause a double free of out_buf. Fix by removing the free (out_buf) in __libelf_compress. Signed-off-by: Mark Wielaard --- libelf/ChangeLog | 4 ++++ libelf/elf_compress.c | 1 - 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/libelf/ChangeLog b/libelf/ChangeLog index 8f79a625..56f5354c 100644 --- a/libelf/ChangeLog +++ b/libelf/ChangeLog @@ -1,3 +1,7 @@ +2020-04-25 Mark Wielaard + + * elf_compress.c (__libelf_compress): Remove free (out_buf). + 2020-03-18 Omar Sandoval * elf_getphdrnum.c (__elf_getphdrnum_rdlock): Call diff --git a/libelf/elf_compress.c b/libelf/elf_compress.c index b1b89689..e5d3d2e0 100644 --- a/libelf/elf_compress.c +++ b/libelf/elf_compress.c @@ -113,7 +113,6 @@ __libelf_compress (Elf_Scn *scn, size_t hsize, int ei_data, int zrc = deflateInit (&z, Z_BEST_COMPRESSION); if (zrc != Z_OK) { - free (out_buf); __libelf_seterrno (ELF_E_COMPRESS_ERROR); return deflate_cleanup(NULL, NULL); } -- 2.26.0