From 84f24da3544abb7b6db102191bf7f98230a3af30 Mon Sep 17 00:00:00 2001 From: Josh Law Date: Fri, 6 Mar 2026 16:16:47 +0000 Subject: [PATCH] lib/inflate: fix memory leak in inflate_dynamic() on inflate_codes() failure When inflate_codes() fails in inflate_dynamic(), the code jumps to the 'out' label which only frees 'll', leaking the Huffman tables 'tl' and 'td'. Restructure the code so that the decoding tables are always freed before reaching the 'out' label. Link: https://lkml.kernel.org/r/20260306161647.2811874-1-objecting@objecting.org Signed-off-by: Josh Law Reviewed-by: Andrew Morton Signed-off-by: Andrew Morton --- lib/inflate.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/lib/inflate.c b/lib/inflate.c index 5b1e70d0ce8c..ae704e4f64ec 100644 --- a/lib/inflate.c +++ b/lib/inflate.c @@ -1009,10 +1009,10 @@ DEBG("dyn5d "); DEBG("dyn6 "); /* decompress until an end-of-block code */ - if (inflate_codes(tl, td, bl, bd)) { + if (inflate_codes(tl, td, bl, bd)) ret = 1; - goto out; - } + else + ret = 0; DEBG("dyn7 "); @@ -1021,7 +1021,6 @@ DEBG("dyn7 "); huft_free(td); DEBG(">"); - ret = 0; out: free(ll); return ret;