Hi Sandeep,

On 2023/9/20 05:02, Sandeep Dhavale wrote:
We move `idx` pointer as we iterate through for loop based on `count`. If
we error out from the loop, restore the pointer to allocated memory
before calling free().

Fixes: 39147b48b76d ("erofs-utils: lib: add erofs_rebuild_load_tree() helper")
Signed-off-by: Sandeep Dhavale <[email protected]>

Thanks for the report!

---
  lib/rebuild.c | 1 +
  1 file changed, 1 insertion(+)

diff --git a/lib/rebuild.c b/lib/rebuild.c
index 27a1df4..8739c53 100644
--- a/lib/rebuild.c
+++ b/lib/rebuild.c
@@ -188,6 +188,7 @@ static int erofs_rebuild_fixup_inode_index(struct 
erofs_inode *inode)
        inode->u.chunkformat |= chunkbits - sbi.blkszbits;
        return 0;
  err:
+       idx = inode->chunkindexes;
        free(idx);

I think we could just

        free(inode->chunkindexes);
        inode->chunkindexes = NULL;

I will apply like this directly.

Thanks,
Gao Xiang

        inode->chunkindexes = NULL;
        return ret;

Reply via email to