From: Tobias Stoeckmann <tobias@stoeckmann.org>
Date: Tue, 3 Jun 2025 15:51:28 +0000 (+0200)
Subject: open_filename: Free memory on error paths
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=refs%2Fpull%2F2663%2Fhead;p=thirdparty%2Flibarchive.git

open_filename: Free memory on error paths

If opening a filename fails, make sure that allocated memory which is
not inserted into any remaining structure is freed.

Fixes https://github.com/libarchive/libarchive/issues/1949

Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
---

diff --git a/libarchive/archive_read_open_filename.c b/libarchive/archive_read_open_filename.c
index 5f5b3f1f7..0fb72c9e0 100644
--- a/libarchive/archive_read_open_filename.c
+++ b/libarchive/archive_read_open_filename.c
@@ -136,8 +136,10 @@ archive_read_open_filenames(struct archive *a, const char **filenames,
 			mine->filename_type = FNT_STDIN;
 		} else
 			mine->filename_type = FNT_MBS;
-		if (archive_read_append_callback_data(a, mine) != (ARCHIVE_OK))
+		if (archive_read_append_callback_data(a, mine) != (ARCHIVE_OK)) {
+			free(mine);
 			return (ARCHIVE_FATAL);
+		}
 		if (filenames == NULL)
 			break;
 		filename = *(filenames++);
@@ -216,8 +218,10 @@ archive_read_open_filenames_w(struct archive *a, const wchar_t **wfilenames,
 			archive_string_free(&fn);
 #endif
 		}
-		if (archive_read_append_callback_data(a, mine) != (ARCHIVE_OK))
+		if (archive_read_append_callback_data(a, mine) != (ARCHIVE_OK)) {
+			free(mine);
 			return (ARCHIVE_FATAL);
+		}
 		if (wfilenames == NULL)
 			break;
 		wfilename = *(wfilenames++);
diff --git a/libarchive/archive_write_open_filename.c b/libarchive/archive_write_open_filename.c
index 342094265..633f7fe17 100644
--- a/libarchive/archive_write_open_filename.c
+++ b/libarchive/archive_write_open_filename.c
@@ -108,6 +108,7 @@ open_filename(struct archive *a, int mbs_fn, const void *filename)
 	else
 		r = archive_mstring_copy_wcs(&mine->filename, filename);
 	if (r < 0) {
+		free(mine);
 		if (errno == ENOMEM) {
 			archive_set_error(a, ENOMEM, "No memory");
 			return (ARCHIVE_FATAL);