lib/inflate: fix memory leak in inflate_fixed() on inflate_codes() failure

When inflate_codes() fails in inflate_fixed(), only the length list 'l' is
freed, but the Huffman tables 'tl' and 'td' are leaked.  Add the missing
huft_free() calls on the error path.

Link: https://lkml.kernel.org/r/20260306161612.2811703-1-objecting@objecting.org
Signed-off-by: Josh Law <objecting@objecting.org>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>

diff --git a/lib/inflate.c b/lib/inflate.c
index eab886baa1b488c686f37e4e1a632847d7f0eec7..5b1e70d0ce8c8b3a55f80b5ed2aecf66d52069af 100644 (file)
--- a/lib/inflate.c
+++ b/lib/inflate.c
@@ -811,6 +811,8 @@ DEBG("<fix");
 
   /* decompress until an end-of-block code */
   if (inflate_codes(tl, td, bl, bd)) {
+    huft_free(tl);
+    huft_free(td);
     free(l);
     return 1;
   }