# HG changeset patch # User Gregory Szorc # Date 2017-01-17 18:17:13 # Node ID 08fa3a76a0803cbae15883ee9521fe2dc4eda96d # Parent 08b34c3a6f74800b5b357f371568177827963e2b zstd: prevent potential free() of uninitialized memory This is a cherry pick of an upstream fix. The free() of uninitialed memory could likely only occur if a malloc() inside zstd fails. The patched functions aren't currently used by Mercurial. But I don't like leaving footguns sitting around. diff --git a/contrib/python-zstandard/c-ext/compressor.c b/contrib/python-zstandard/c-ext/compressor.c --- a/contrib/python-zstandard/c-ext/compressor.c +++ b/contrib/python-zstandard/c-ext/compressor.c @@ -258,6 +258,9 @@ static PyObject* ZstdCompressor_copy_str return NULL; } + /* Prevent free on uninitialized memory in finally. */ + output.dst = NULL; + cstream = CStream_from_ZstdCompressor(self, sourceSize); if (!cstream) { res = NULL; diff --git a/contrib/python-zstandard/c-ext/decompressor.c b/contrib/python-zstandard/c-ext/decompressor.c --- a/contrib/python-zstandard/c-ext/decompressor.c +++ b/contrib/python-zstandard/c-ext/decompressor.c @@ -165,6 +165,9 @@ static PyObject* Decompressor_copy_strea return NULL; } + /* Prevent free on uninitialized memory in finally. */ + output.dst = NULL; + dstream = DStream_from_ZstdDecompressor(self); if (!dstream) { res = NULL;