From 5f729580a0cd30ecb8032b5d17c7c8ed973b83f5 Mon Sep 17 00:00:00 2001 From: Johannes Schindelin Date: Wed, 1 Jul 2026 07:04:25 +0000 Subject: [PATCH] dir: free allocations on parse-error paths in read_one_dir() When read_one_dir() encounters a parse error while reading the untracked cache from disk, it returns -1 immediately. Two allocations made earlier in the function can leak on these early-return paths: ud.untracked (allocated at line 3846 when untracked_nr > 0) and ud.dirs (allocated at line 3851). Free both before returning on the two error paths between these allocations and the point where they are transferred into the final xmalloc'd struct at line 3857. Pointed out by Coverity. Assisted-by: Claude Opus 4.6 Signed-off-by: Johannes Schindelin Signed-off-by: Junio C Hamano --- dir.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/dir.c b/dir.c index 32430090dc..23335b9f7a 100644 --- a/dir.c +++ b/dir.c @@ -3792,13 +3792,18 @@ static int read_one_dir(struct untracked_cache_dir **untracked_, ALLOC_ARRAY(ud.untracked, ud.untracked_nr); ud.dirs_alloc = ud.dirs_nr = decode_varint(&data); - if (data > end) + if (data > end) { + free(ud.untracked); return -1; + } ALLOC_ARRAY(ud.dirs, ud.dirs_nr); eos = memchr(data, '\0', end - data); - if (!eos || eos == end) + if (!eos || eos == end) { + free(ud.untracked); + free(ud.dirs); return -1; + } *untracked_ = untracked = xmalloc(st_add3(sizeof(*untracked), eos - data, 1)); memcpy(untracked, &ud, sizeof(ud));