#1012525 gensquashfs: double free detected in tcache 2

Package:
squashfs-tools-ng
Source:
squashfs-tools-ng
Description:
New set of tools for working with SquashFS images
Submitter:
Marvin Renich
Date:
2022-06-08 18:09:04 UTC
Severity:
minor
#1012525#5
Date:
2022-06-08 18:05:52 UTC
From:
To:
In mknode.c:fstree_mknode, if the parent directory link count is too
large, the tree_node_t that was just calloc'ed is free'd before
returning.  However, it has already been linked to the parent's children
list.  This causes a double free of that pointer when the parent is
subsequently free'd.  Also, all of the other children may not be free'd
and/or free may be called with invalid pointers, depending on whether
the just-freed memory gets reallocated and used before exit.

This is only a minor bug, because gensquashfs is about to exit with an
error, but it clutters stderr with irrelevant messages.

I didn't follow the error return path to be sure, but I think if the
call to free(n) just before errno = EMLINK is removed, everything will
get properly freed farther up the call stack.

...Marvin