Hello,

In cdio's read_track() the error condition around sio_write() doesn't free 
local storage "sec"
before it returns. The other error cases appear to free it.

- Michael


Index: rip.c
===================================================================
RCS file: /cvs/src/usr.bin/cdio/rip.c,v
retrieving revision 1.16
diff -u -p -u -r1.16 rip.c
--- rip.c       20 Aug 2015 22:32:41 -0000      1.16
+++ rip.c       19 Jun 2017 03:27:14 -0000
@@ -398,6 +398,7 @@ read_track(struct track *ti)
                        }
                        if (ti->hdl != NULL &&
                            (sio_write(ti->hdl, sec, blksize) == 0)) {
+                               free(sec);
                                sio_close(ti->hdl);
                                ti->hdl = NULL;
                                warnx("\nerror while writing to audio output");

Reply via email to