Patch for the invalid free described in #1153067. `wvGetBKD_PLCF()` and the nine sibling PLCF parsers free the address of the `U32 **pos` parameter instead of the buffer it points to on the allocation-failure path. The patch changes every `wvFree (pos)` to `wvFree (*pos)` in the affected parsers, so the actual heap block is released and `*pos` is then cleared.
Tested on a plain/optimised build of 1.2.9 with the patch applied: - simple-bkd-len4.doc: `free(): invalid pointer`, abort (rc=134) before, rc=0 after - simple-bkd-len13.doc: same before/after result - wv-corpus/backslash.doc: RTF output SHA-256 identical before and after The patch is `-p1` and touches only the affected `wvFree` call sites plus the surrounding files listed in the diff. Happy to retest or rework the approach.
wv-invalid-free.patch
Description: wv-invalid-free.patch
# Fix verification: BTS #1153067 Tree: `~/fuzz/wv-fix3` (copy of the unpatched `wv-clean`) Patch: `wv-invalid-free.patch` (7410 bytes, `-p1`) ## Change Every `wvFree (pos);` on the PLCF allocation-failure path becomes `wvFree (*pos);` so the heap buffer is released and `*pos` cleared. Affects `wvGetBKD_PLCF()` and the nine copy-pasted sibling parsers. ## Verification | input | before (wv-clean) | after (wv-fix3) | |---|---|---| | `simple-bkd-len4.doc` | `free(): invalid pointer`, abort rc=134 | rc=0 | | `simple-bkd-len13.doc` | `free(): invalid pointer`, abort rc=134 | rc=0 | | `wv-corpus/backslash.doc` | normal output | byte-identical output, SHA-256 match | Normal-document output hash before and after: `cb0ecb596eefc6db9836c2853e9b53534f7c88d85905a06dc05815312c02345a`. Patch applies cleanly with `patch -p1` and the tree rebuilds without warnings on these files.
