From: Mark Adler <madler@alumni.caltech.edu>
Date: Tue, 2 Oct 2012 05:42:35 +0000 (-0700)
Subject: Fix bug in gzclose() when gzwrite() runs out of memory.
X-Git-Tag: v1.2.7.1~30
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c4888637eaee189c0e21259cb87ab7e5e1d4ce76;p=thirdparty%2Fzlib-ng.git

Fix bug in gzclose() when gzwrite() runs out of memory.

If the deflateInit2() called for the first gzwrite() failed with a
Z_MEM_ERROR, then a subsequent gzclose() would try to free an
already freed pointer.  This fixes that.
---

diff --git a/gzwrite.c b/gzwrite.c
index 79a69a5cd..1b06cdd10 100644
--- a/gzwrite.c
+++ b/gzwrite.c
@@ -556,12 +556,13 @@ int ZEXPORT gzclose_w(file)
     /* flush, free memory, and close file */
     if (gz_comp(state, Z_FINISH) == -1)
         ret = state->err;
-    if (!state->direct) {
-        (void)deflateEnd(&(state->strm));
-        free(state->out);
-    }
-    if (state->size)
+    if (state->size) {
+        if (!state->direct) {
+            (void)deflateEnd(&(state->strm));
+            free(state->out);
+        }
         free(state->in);
+    }
     gz_error(state, Z_OK, NULL);
     free(state->path);
     if (close(state->fd) == -1)