From: Anton Moryakov <ant.v.morya...@gmail.com>

Static analyzer triggering:
Dynamic memory, referenced by 'subpart_dir_buff.name', is allocated at 
ifwitool.c:1132 
by calling function 'parse_subpart_dir' at ifwitool.c:1878 and lost at 
ifwitool.c:1904.

Correct explained:
Added a missing call to buffer_delete() in the function ifwi_dir_extract()
to properly release dynamically allocated memory associated with
subpart_dir_buff.

Previously, in case the requested entry was not found (i == num_entries)
or when buffer_write_file() failed, the function would exit or return
without freeing this memory, leading to a potential memory leak.

This change ensures that all exit paths free the associated buffer
correctly, even before calling exit(-1).

Signed-off-by: Anton Moryakov <ant.v.morya...@gmail.com>
---
 tools/ifwitool.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/tools/ifwitool.c b/tools/ifwitool.c
index c1defe57737..762161d769e 100644
--- a/tools/ifwitool.c
+++ b/tools/ifwitool.c
@@ -1890,6 +1890,7 @@ static enum ifwi_ret ifwi_dir_extract(int type)
        if (i == s->h.num_entries) {
                ERROR("Entry %s not found in subpartition for %s.\n",
                      param.dentry_name, param.subpart_name);
+               buffer_delete(&subpart_dir_buff);
                exit(-1);
        }
 
@@ -1900,12 +1901,15 @@ static enum ifwi_ret ifwi_dir_extract(int type)
        buffer_splice(&dst, &ifwi_image.subpart_buf[type], s->e[i].offset,
                      s->e[i].length);
 
-       if (buffer_write_file(&dst, param.file_name))
+       if (buffer_write_file(&dst, param.file_name)) {
+               buffer_delete(&subpart_dir_buff);
                return COMMAND_ERR;
+       }
 
        printf("Sub-Partition %s(%d), entry(%s) stored in %s.\n",
               param.subpart_name, type, param.dentry_name, param.file_name);
 
+       buffer_delete(&subpart_dir_buff);
        return NO_ACTION_REQUIRED;
 }
 
-- 
2.30.2

Reply via email to