From: Josh Law <objecting@objecting.org>
Date: Fri, 6 Mar 2026 16:16:12 +0000 (+0000)
Subject: lib/inflate: fix memory leak in inflate_fixed() on inflate_codes() failure
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=bc6cc36855e9ebcf0c7e01f980ad67bcb0e50bdb;p=thirdparty%2Fkernel%2Fstable.git

lib/inflate: fix memory leak in inflate_fixed() on inflate_codes() failure

When inflate_codes() fails in inflate_fixed(), only the length list 'l' is
freed, but the Huffman tables 'tl' and 'td' are leaked.  Add the missing
huft_free() calls on the error path.

Link: https://lkml.kernel.org/r/20260306161612.2811703-1-objecting@objecting.org
Signed-off-by: Josh Law <objecting@objecting.org>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

diff --git a/lib/inflate.c b/lib/inflate.c
index eab886baa1b4..5b1e70d0ce8c 100644
--- a/lib/inflate.c
+++ b/lib/inflate.c
@@ -811,6 +811,8 @@ DEBG("<fix");
 
   /* decompress until an end-of-block code */
   if (inflate_codes(tl, td, bl, bd)) {
+    huft_free(tl);
+    huft_free(td);
     free(l);
     return 1;
   }