diff options
author | Mark Adler <madler@alumni.caltech.edu> | 2012-10-01 22:42:35 -0700 |
---|---|---|
committer | Mark Adler <madler@alumni.caltech.edu> | 2012-10-01 22:52:16 -0700 |
commit | c4888637eaee189c0e21259cb87ab7e5e1d4ce76 (patch) | |
tree | 8a07d3885317a18a6411d907bdddcbd3a96b5039 /gzwrite.c | |
parent | 0cf495a1ca941428c0b11e2307cad760ae44993e (diff) | |
download | zlib-c4888637eaee189c0e21259cb87ab7e5e1d4ce76.tar.gz zlib-c4888637eaee189c0e21259cb87ab7e5e1d4ce76.tar.bz2 zlib-c4888637eaee189c0e21259cb87ab7e5e1d4ce76.zip |
Fix bug in gzclose() when gzwrite() runs out of memory.
If the deflateInit2() called for the first gzwrite() failed with a
Z_MEM_ERROR, then a subsequent gzclose() would try to free an
already freed pointer. This fixes that.
Diffstat (limited to 'gzwrite.c')
-rw-r--r-- | gzwrite.c | 11 |
1 files changed, 6 insertions, 5 deletions
@@ -556,12 +556,13 @@ int ZEXPORT gzclose_w(file) | |||
556 | /* flush, free memory, and close file */ | 556 | /* flush, free memory, and close file */ |
557 | if (gz_comp(state, Z_FINISH) == -1) | 557 | if (gz_comp(state, Z_FINISH) == -1) |
558 | ret = state->err; | 558 | ret = state->err; |
559 | if (!state->direct) { | 559 | if (state->size) { |
560 | (void)deflateEnd(&(state->strm)); | 560 | if (!state->direct) { |
561 | free(state->out); | 561 | (void)deflateEnd(&(state->strm)); |
562 | } | 562 | free(state->out); |
563 | if (state->size) | 563 | } |
564 | free(state->in); | 564 | free(state->in); |
565 | } | ||
565 | gz_error(state, Z_OK, NULL); | 566 | gz_error(state, Z_OK, NULL); |
566 | free(state->path); | 567 | free(state->path); |
567 | if (close(state->fd) == -1) | 568 | if (close(state->fd) == -1) |