When there is an error in dwarf_getscopes after the initial scopes
have been allocated, e.g. when looking for the inlined scopes, then
the scopes would leak. Fix this by explicitly free the scopes on error.

https://sourceware.org/bugzilla/show_bug.cgi?id=29434

Signed-off-by: Mark Wielaard <m...@klomp.org>
---
 libdw/ChangeLog         | 5 +++++
 libdw/dwarf_getscopes.c | 4 +++-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/libdw/ChangeLog b/libdw/ChangeLog
index e0cd8f21..fefc53af 100644
--- a/libdw/ChangeLog
+++ b/libdw/ChangeLog
@@ -1,3 +1,8 @@
+2023-02-22  Mark Wielaard  <m...@klomp.org>
+
+       * dwarf_getscopes.c (origin_match): Don't free a->scopes.
+       (dwarf_getscopes): Free a->scopes on error.
+
 2023-02-14  Mark Wielaard  <m...@klomp.org>
 
        * dwarf_getlocation.c (__libdw_intern_expression): Correct check
diff --git a/libdw/dwarf_getscopes.c b/libdw/dwarf_getscopes.c
index 833f1ac5..ce073b13 100644
--- a/libdw/dwarf_getscopes.c
+++ b/libdw/dwarf_getscopes.c
@@ -101,7 +101,7 @@ origin_match (unsigned int depth, struct Dwarf_Die_Chain 
*die, void *arg)
   Dwarf_Die *scopes = realloc (a->scopes, nscopes * sizeof scopes[0]);
   if (scopes == NULL)
     {
-      free (a->scopes);
+      /* a->scopes will be freed by dwarf_getscopes on error.  */
       __libdw_seterrno (DWARF_E_NOMEM);
       return -1;
     }
@@ -200,6 +200,8 @@ dwarf_getscopes (Dwarf_Die *cudie, Dwarf_Addr pc, Dwarf_Die 
**scopes)
 
   if (result > 0)
     *scopes = a.scopes;
+  else if (result < 0)
+    free (a.scopes);
 
   return result;
 }
-- 
2.31.1

Reply via email to