iso9660: Fix memory leaks on error paths

- Release memory in case of allocation failure.
- Treat failure to add an entry to rr_moved as fatal error

Fixes ASAN test run with test_write_format_iso9660_null_deref

Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>

diff --git a/libarchive/archive_write_set_format_iso9660.c b/libarchive/archive_write_set_format_iso9660.c
index 00ea5adbdadf6a707e82e7f94543e59d243b31cc..d99c7ac4c7abbffd2dc468b577327bd960eca742 100644 (file)
--- a/libarchive/archive_write_set_format_iso9660.c
+++ b/libarchive/archive_write_set_format_iso9660.c
@@ -1170,6 +1170,7 @@ archive_write_set_format_iso9660(struct archive *_a)
        iso9660->cur_dirent = iso9660->primary.rootent;
        archive_string_init(&(iso9660->cur_dirstr));
        if (archive_string_ensure(&(iso9660->cur_dirstr), 1) == NULL) {
+               free(iso9660->cur_dirent);
                free(iso9660);
                archive_set_error(&a->archive, ENOMEM,
                    "Can't allocate memory");
@@ -6764,7 +6765,12 @@ isoent_rr_move_dir(struct archive_write *a, struct isoent **rr_moved,
        /*
         * The mvent becomes a child of the rr_moved entry.
         */
-       isoent_add_child_tail(rrmoved, mvent);
+       if (!isoent_add_child_tail(rrmoved, mvent)) {
+               _isoent_free(mvent);
+               archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
+                   "Unable to insert rr_moved entry");
+               return (ARCHIVE_FATAL);
+       }
        archive_entry_set_nlink(rrmoved->file->entry,
            archive_entry_nlink(rrmoved->file->entry) + 1);
        /*