From 98546092b91380512c5357b8d14d73aed14c1cfc Mon Sep 17 00:00:00 2001 From: Tobias Stoeckmann Date: Mon, 10 Aug 2026 19:48:26 +0200 Subject: [PATCH] Fix memory leaks on open error paths If open functions fail to store client data, free internally allocated memory before returning an error code. Writer open functions must check magic themselves. Signed-off-by: Tobias Stoeckmann --- libarchive/archive_read_open_fd.c | 5 ++++- libarchive/archive_read_open_file.c | 5 ++++- libarchive/archive_read_open_memory.c | 4 +++- libarchive/archive_write_open_fd.c | 4 ++++ libarchive/archive_write_open_file.c | 4 ++++ libarchive/archive_write_open_filename.c | 3 +++ libarchive/archive_write_open_memory.c | 4 ++++ 7 files changed, 26 insertions(+), 3 deletions(-) diff --git a/libarchive/archive_read_open_fd.c b/libarchive/archive_read_open_fd.c index 358e516f..97c944b8 100644 --- a/libarchive/archive_read_open_fd.c +++ b/libarchive/archive_read_open_fd.c @@ -109,8 +109,11 @@ archive_read_open_fd(struct archive *a, int fd, size_t block_size) archive_read_set_seek_callback(a, file_seek); archive_read_set_close_callback(a, file_close); r = archive_read_set_callback_data(a, mine); - if (r < 0) + if (r < 0) { + free(mine->buffer); + free(mine); return (r); + } return (archive_read_open1(a)); } diff --git a/libarchive/archive_read_open_file.c b/libarchive/archive_read_open_file.c index e82069e5..f6dcf82f 100644 --- a/libarchive/archive_read_open_file.c +++ b/libarchive/archive_read_open_file.c @@ -106,8 +106,11 @@ archive_read_open_FILE(struct archive *a, FILE *f) archive_read_set_seek_callback(a, FILE_seek); archive_read_set_close_callback(a, FILE_close); r = archive_read_set_callback_data(a, mine); - if (r < 0) + if (r < 0) { + free(mine->buffer); + free(mine); return (r); + } return (archive_read_open1(a)); } diff --git a/libarchive/archive_read_open_memory.c b/libarchive/archive_read_open_memory.c index 441662d4..5165d1b7 100644 --- a/libarchive/archive_read_open_memory.c +++ b/libarchive/archive_read_open_memory.c @@ -84,8 +84,10 @@ archive_read_open_memory2(struct archive *a, const void *buff, archive_read_set_skip_callback(a, memory_read_skip); archive_read_set_close_callback(a, memory_read_close); r = archive_read_set_callback_data(a, mine); - if (r < 0) + if (r < 0) { + free(mine); return (r); + } return (archive_read_open1(a)); } diff --git a/libarchive/archive_write_open_fd.c b/libarchive/archive_write_open_fd.c index a7955520..45ec492d 100644 --- a/libarchive/archive_write_open_fd.c +++ b/libarchive/archive_write_open_fd.c @@ -48,6 +48,7 @@ #endif #include "archive.h" +#include "archive_private.h" struct write_fd_data { int fd; @@ -62,6 +63,9 @@ archive_write_open_fd(struct archive *a, int fd) { struct write_fd_data *mine; + archive_check_magic(a, ARCHIVE_WRITE_MAGIC, + ARCHIVE_STATE_NEW, "archive_write_open_fd"); + mine = malloc(sizeof(*mine)); if (mine == NULL) { archive_set_error(a, ENOMEM, "No memory"); diff --git a/libarchive/archive_write_open_file.c b/libarchive/archive_write_open_file.c index 6271b368..c4e73fd8 100644 --- a/libarchive/archive_write_open_file.c +++ b/libarchive/archive_write_open_file.c @@ -45,6 +45,7 @@ #endif #include "archive.h" +#include "archive_private.h" struct write_FILE_data { FILE *f; @@ -59,6 +60,9 @@ archive_write_open_FILE(struct archive *a, FILE *f) { struct write_FILE_data *mine; + archive_check_magic(a, ARCHIVE_WRITE_MAGIC, + ARCHIVE_STATE_NEW, "archive_write_open_FILE"); + mine = malloc(sizeof(*mine)); if (mine == NULL) { archive_set_error(a, ENOMEM, "No memory"); diff --git a/libarchive/archive_write_open_filename.c b/libarchive/archive_write_open_filename.c index 430de21f..df513260 100644 --- a/libarchive/archive_write_open_filename.c +++ b/libarchive/archive_write_open_filename.c @@ -98,6 +98,9 @@ open_filename(struct archive *a, int mbs_fn, const void *filename) struct write_file_data *mine; int r; + archive_check_magic(a, ARCHIVE_WRITE_MAGIC, + ARCHIVE_STATE_NEW, "open_filename"); + mine = calloc(1, sizeof(*mine)); if (mine == NULL) { archive_set_error(a, ENOMEM, "No memory"); diff --git a/libarchive/archive_write_open_memory.c b/libarchive/archive_write_open_memory.c index 3b929ac7..e88d88c6 100644 --- a/libarchive/archive_write_open_memory.c +++ b/libarchive/archive_write_open_memory.c @@ -30,6 +30,7 @@ #include #include "archive.h" +#include "archive_private.h" struct write_memory_data { size_t used; @@ -52,6 +53,9 @@ archive_write_open_memory(struct archive *a, void *buff, size_t buffSize, size_t { struct write_memory_data *mine; + archive_check_magic(a, ARCHIVE_WRITE_MAGIC, + ARCHIVE_STATE_NEW, "archive_write_open_memory"); + mine = calloc(1, sizeof(*mine)); if (mine == NULL) { archive_set_error(a, ENOMEM, "No memory");