Subject: [PATCH v2] reftable/writer: fix memory leak if write fails

From: "Lidong Yan via GitGitGadget" <[email-masked]>
Date: Sun, 11 May 2025 16:16:04 +0000

From: Lidong Yan <[email-masked]>

In reftable/writer.c:padded_write(), if w->writer failed, zeroed
allocated in `reftable_calloc` will leak. w->writer could be
`reftable_write_data` in reftable/stack.c, and could fail due to
some write error. Simply add reftable_free(zeroed) will solve this
problem.

In reftable/writer.c:writer_index_hash(), if `reftable_buf_add` failed,
key allocated by `reftable_malloc` will not be insert into `obj_index_tree`
thus leaks. Simple add reftable_free(key) will solve this problem.

Signed-off-by: Lidong Yan <[email-masked]>
---
    reftable/writer: fix memory leak when padded_write() fails
    
    In reftable/writer.c:padded_write(), if w->writer failed, zeroed
    allocated in reftable_calloc will leak. w->writer could be
    reftable_write_data in reftable/stack.c, and could fail due to some
    write error. Simply add reftable_free(zeroed) will solve this problem.

Published-As: https://github.com/gitgitgadget/git/releases/tag/pr-git-1958%2Fbrandb97%2Ffix-reftable-padded-write-leak-v2
Fetch-It-Via: git fetch https://github.com/gitgitgadget/git pr-git-1958/brandb97/fix-reftable-padded-write-leak-v2
Pull-Request: https://github.com/git/git/pull/1958

Range-diff vs v1:

 1:  2023d6791ef ! 1:  9329ae2d478 reftable/writer: fix memory leak when `padded_write()` fails
     @@ Metadata
      Author: Lidong Yan <[email-masked]>
      
       ## Commit message ##
     -    reftable/writer: fix memory leak when `padded_write()` fails
     +    reftable/writer: fix memory leak if write fails
      
          In reftable/writer.c:padded_write(), if w->writer failed, zeroed
          allocated in `reftable_calloc` will leak. w->writer could be
     @@ Commit message
          some write error. Simply add reftable_free(zeroed) will solve this
          problem.
      
     +    In reftable/writer.c:writer_index_hash(), if `reftable_buf_add` failed,
     +    key allocated by `reftable_malloc` will not be insert into `obj_index_tree`
     +    thus leaks. Simple add reftable_free(key) will solve this problem.
     +
          Signed-off-by: Lidong Yan <[email-masked]>
      
       ## reftable/writer.c ##
     @@ reftable/writer.c: static int padded_write(struct reftable_writer *w, uint8_t *d
       
       		w->pending_padding = 0;
       		reftable_free(zeroed);
     +@@ reftable/writer.c: static int writer_index_hash(struct reftable_writer *w, struct reftable_buf *has
     + 
     + 		reftable_buf_reset(&key->hash);
     + 		err = reftable_buf_add(&key->hash, hash->buf, hash->len);
     +-		if (err < 0)
     ++		if (err < 0) {
     ++			reftable_free(key);
     + 			return err;
     ++		}
     + 		tree_insert(&w->obj_index_tree, key,
     + 			    &obj_index_tree_node_compare);
     + 	} else {

 reftable/writer.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/reftable/writer.c b/reftable/writer.c
index cb16f71be49..3b4ebdd6dce 100644
--- a/reftable/writer.c
+++ b/reftable/writer.c
@@ -57,8 +57,10 @@ static int padded_write(struct reftable_writer *w, uint8_t *data, size_t len,
 			return -1;
 
 		n = w->write(w->write_arg, zeroed, w->pending_padding);
-		if (n < 0)
+		if (n < 0) {
+			reftable_free(zeroed);
 			return n;
+		}
 
 		w->pending_padding = 0;
 		reftable_free(zeroed);
@@ -256,8 +258,10 @@ static int writer_index_hash(struct reftable_writer *w, struct reftable_buf *has
 
 		reftable_buf_reset(&key->hash);
 		err = reftable_buf_add(&key->hash, hash->buf, hash->len);
-		if (err < 0)
+		if (err < 0) {
+			reftable_free(key);
 			return err;
+		}
 		tree_insert(&w->obj_index_tree, key,
 			    &obj_index_tree_node_compare);
 	} else {

base-commit: 6f84262c44a89851c3ae5a6e4c1a9d06b2068d75
-- 
gitgitgadget