fuzz - 12122 - Fix to memory leak by properly free'ing the dirname variable in OLE2 parser.

val-ms · val-ms · commit 392e3446363c · 2019-02-28T09:58:55.000-08:00
diff --git a/libclamav/ole2_extract.c b/libclamav/ole2_extract.c
@@ -755,10 +755,16 @@ ole2_walk_property_tree(ole2_header_t *hdr, const char *dir, int32_t prop_index,
                             func_ret = ret;
                         } else {
                             ole2_list_delete(&node_list);
+                            if (dirname)
+                                free(dirname);
                             return ret;
                         }
                     }
                 }
+                if (dirname) {
+                    free(dirname);
+                    dirname = NULL;
+                }
                 if ((int)(prop_block[idx].prev) != -1) {
                     if ((ret = ole2_list_push(&node_list, prop_block[idx].prev)) != CL_SUCCESS) {
                         ole2_list_delete(&node_list);
@@ -771,8 +777,6 @@ ole2_walk_property_tree(ole2_header_t *hdr, const char *dir, int32_t prop_index,
                         return ret;
                     }
                 }
-                if (dirname)
-                    free(dirname);
                 break;
             default:
                 cli_dbgmsg("ERROR: unknown OLE2 entry type: %d\n", prop_block[idx].type);

Original file line number	Diff line number	Diff line change
`@@ -755,10 +755,16 @@ ole2_walk_property_tree(ole2_header_t hdr, const char dir, int32_t prop_index,`
`755`	`755`	`func_ret = ret;`
`756`	`756`	`} else {`
`757`	`757`	`ole2_list_delete(&node_list);`
	`758`	`+ if (dirname)`
	`759`	`+ free(dirname);`
`758`	`760`	`return ret;`
`759`	`761`	`}`
`760`	`762`	`}`
`761`	`763`	`}`
	`764`	`+ if (dirname) {`
	`765`	`+ free(dirname);`
	`766`	`+ dirname = NULL;`
	`767`	`+ }`
`762`	`768`	`if ((int)(prop_block[idx].prev) != -1) {`
`763`	`769`	`if ((ret = ole2_list_push(&node_list, prop_block[idx].prev)) != CL_SUCCESS) {`
`764`	`770`	`ole2_list_delete(&node_list);`
`@@ -771,8 +777,6 @@ ole2_walk_property_tree(ole2_header_t hdr, const char dir, int32_t prop_index,`
`771`	`777`	`return ret;`
`772`	`778`	`}`
`773`	`779`	`}`
`774`		`- if (dirname)`
`775`		`- free(dirname);`
`776`	`780`	`break;`
`777`	`781`	`default:`
`778`	`782`	`cli_dbgmsg("ERROR: unknown OLE2 entry type: %d\n", prop_block[idx].type);`