GitList

Browse code

Fix lzma-sdk xz bug

A use-after-free read is possible in the Xz decoder cleanup.

The fix is to set a pointer to NULL so it doesn't try to
dereference it and free a second time.

Fixes https://issues.oss-fuzz.com/issues/384549094

This fix is also present in lzma-sdk version 18.01.
Ref: https://github.com/welovegit/LZMA-SDK/blame/main/C/XzDec.c#L508

Val Snyder authored on 2025/03/13 05:08:25
Showing 1 changed files

libclamav/7z/XzDec.c index 00a2870..7e40d20 100644

libclamav/7z/XzDec.c

History View file @ fd9cf81

@@ -343,8 +343,10 @@ void MixCoder_Free(CMixCoder *p)
                        for (i = 0; i < p->numCoders; i++)
+                       {
                          IStateCoder *sc = &p->coders[i];
                     -    if (p->alloc && sc->p)
                     +    if (p->alloc && sc->p) {
                            sc->Free(sc->p, p->alloc);
                     +      sc->p = NULL;
                     +    }
+                       }
                        p->numCoders = 0;
                        if (p->buf)