In sqfs_search_dir(), when sqfs_find_inode() fails to locate the inode of a directory entry just returned by sqfs_readdir_nest(), the function returns directly while dirs->entry still holds the entry allocation, leaking it. The bare return also bypasses the regular error path.
Free the entry and leave through the out label instead, consistent with the other error paths in this function. Signed-off-by: Allan ELKAIM <[email protected]> --- Changes in v2: - New patch, fixing a pre-existing leak of the same kind as the ones addressed in patch 2 (suggested by Richard Genoud's review) fs/squashfs/sqfs.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/fs/squashfs/sqfs.c b/fs/squashfs/sqfs.c index af32d008..df988774 100644 --- a/fs/squashfs/sqfs.c +++ b/fs/squashfs/sqfs.c @@ -547,8 +547,12 @@ static int sqfs_search_dir(struct squashfs_dir_stream *dirs, char **token_list, /* Get reference to inode in the inode table */ table = sqfs_find_inode(dirs->inode_table, new_inode_number, sblk->inodes, sblk->block_size); - if (!table) - return -EINVAL; + if (!table) { + free(dirs->entry); + dirs->entry = NULL; + ret = -EINVAL; + goto out; + } dir = (struct squashfs_dir_inode *)table; /* Check for symbolic link and inode type sanity */ -- 2.53.0
