[PATCH] hcom: fix double free on writing zero-length file

[PATCH] hcom: fix double free on writing zero-length file

[Mans Rullgard]

---
 src/hcom.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/hcom.c b/src/hcom.c
index e76820e..c62b020 100644
--- a/src/hcom.c
+++ b/src/hcom.c
@@ -432,9 +432,10 @@ static int stopwrite(sox_format_t * ft)
   int rc = SOX_SUCCESS;
 
   /* Compress it all at once */
-  if (compressed_len)
+  if (compressed_len) {
     compress(ft, &compressed_data, (int32_t *)&compressed_len);
-  free(p->data);
+    free(p->data);
+  }
 
   /* Write the header */
   lsx_writebuf(ft, "\000\001A", (size_t) 3); /* Dummy file name "A" */
-- 
2.5.0


------------------------------------------------------------------------------

Re: [PATCH] hcom: fix double free on writing zero-length file

[Eric Wong]

Mans Rullgard <mans@mansr.com> wrote:
> +++ b/src/hcom.c
> @@ -432,9 +432,10 @@ static int stopwrite(sox_format_t * ft)
>    int rc = SOX_SUCCESS;
>  
>    /* Compress it all at once */
> -  if (compressed_len)
> +  if (compressed_len) {
>      compress(ft, &compressed_data, (int32_t *)&compressed_len);
> -  free(p->data);
> +    free(p->data);
> +  }

Tested successfully with: sox $INPUT x.hcom trim 0

A side note: As somebody who has never heard of hcom until now, much
less read the code, it was not immediately obvious to me what the
problem was or whether it introduced a new leaks until I skimmed through
the entire stopwrite and compress functions :x

------------------------------------------------------------------------------