Skip to content

Commit 4fb9499

Browse files
committed
[SOURCE CHANGE] Fix double-free in ALMemory
1 parent 31a0e85 commit 4fb9499

File tree

1 file changed

+9
-0
lines changed

1 file changed

+9
-0
lines changed

archivelib-sys-orig/c-lib/src/memstore.cpp

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -722,9 +722,18 @@ int AL_PROTO ALMemory::Close()
722722
mpcUserBuffer = (char AL_HUGE *) GlobalLock( (HGLOBAL) mhUserMemoryHandle );
723723
muUserBufferSize = mlSize;
724724
#else
725+
if (mlSize == 0) {
726+
// 2019 -- Added this if/else block to prevent double free.
727+
// Passing `0` into realloc will free the memory, then return
728+
// null. This won't clear the reference to the buffer meaning
729+
// ALMemory's deconstructor tries to free it again.
730+
free(mpcUserBuffer);
731+
mpcUserBuffer = NULL;
732+
} else {
725733
char *new_buf = (char *) realloc( mpcUserBuffer, (size_t) mlSize );
726734
if ( new_buf )
727735
mpcUserBuffer = new_buf;
736+
}
728737
muUserBufferSize = (size_t) mlSize;
729738
#endif
730739
}

0 commit comments

Comments
 (0)