diff options
| author | Martin Pool <mbp@samba.org> | 2002-03-11 05:55:33 +0000 |
|---|---|---|
| committer | Martin Pool <mbp@samba.org> | 2002-03-11 05:55:33 +0000 |
| commit | 567e56313a9c14e877814c1223f5dc8839dc95b3 (patch) | |
| tree | a31c3826d62f74c48bb1d77cdbd3aeab46cd407c /zlib | |
| parent | 9e95e92bdff9c742e06ab237b5aef3d08603e94e (diff) | |
| download | android_external_rsync-567e56313a9c14e877814c1223f5dc8839dc95b3.tar.gz android_external_rsync-567e56313a9c14e877814c1223f5dc8839dc95b3.tar.bz2 android_external_rsync-567e56313a9c14e877814c1223f5dc8839dc95b3.zip | |
Merge zlib double-free bug forwarded by Mark J Cox.
Diffstat (limited to 'zlib')
| -rw-r--r-- | zlib/infblock.c | 12 |
1 files changed, 9 insertions, 3 deletions
diff --git a/zlib/infblock.c b/zlib/infblock.c index 1c221dda..58f0628c 100644 --- a/zlib/infblock.c +++ b/zlib/infblock.c @@ -249,10 +249,12 @@ int r; &s->sub.trees.tb, s->hufts, z); if (t != Z_OK) { - ZFREE(z, s->sub.trees.blens); r = t; if (r == Z_DATA_ERROR) - s->mode = zBAD; + { + ZFREE(z, s->sub.trees.blens); + s->mode = zBAD; + } LEAVE } s->sub.trees.index = 0; @@ -317,10 +319,14 @@ int r; if (t != Z_OK) { if (t == (uInt)Z_DATA_ERROR) - s->mode = zBAD; + { + ZFREE(z, s->sub.trees.blens); + s->mode = zBAD; + } r = t; LEAVE } + ZFREE(z, s->sub.trees.blens); Tracev((stderr, "inflate: trees ok\n")); if ((c = inflate_codes_new(bl, bd, tl, td, z)) == Z_NULL) { |