From 98ae234000abdabf9db125c87a2db8b81157af72 Mon Sep 17 00:00:00 2001
From: "t.feng" <fengtao40@huawei.com>
Date: Tue, 29 Nov 2022 17:14:14 +0800
Subject: [PATCH] fs/squash4: Fix memory leaks in grub_squash_iterate_dir()

Fixes: 20dd511c8 (Handle "." and ".." on squashfs)

Reference:https://git.savannah.gnu.org/cgit/grub.git/commit?id=98ae234000abdabf9db125c87a2db8b81157af72
Conflict:NA

Signed-off-by: t.feng <fengtao40@huawei.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
---
 grub-core/fs/squash4.c | 20 ++++++++++++++++----
 1 file changed, 16 insertions(+), 4 deletions(-)

diff --git a/grub-core/fs/squash4.c b/grub-core/fs/squash4.c
index 02b1f9b6d..a30e6ebe1 100644
--- a/grub-core/fs/squash4.c
+++ b/grub-core/fs/squash4.c
@@ -550,7 +550,10 @@ grub_squash_iterate_dir (grub_fshelp_node_t dir,
 			  + node->stack[node->stsize - 1].ino_chunk,
 			  node->stack[node->stsize - 1].ino_offset);
 	if (err)
-	  return 0;
+	  {
+	    grub_free (node);
+	    return 0;
+	  }
 
 	if (hook ("..", GRUB_FSHELP_DIR, node, hook_data))
 	  return 1;
@@ -600,7 +603,10 @@ grub_squash_iterate_dir (grub_fshelp_node_t dir,
 			    grub_le_to_cpu64 (dir->data->sb.diroffset)
 			    + chunk, off);
 	  if (err)
-	    return 0;
+	    {
+	      grub_free (buf);
+	      return 0;
+	    }
 
 	  off += grub_le_to_cpu16 (di.namelen) + 1;
 	  buf[grub_le_to_cpu16 (di.namelen) + 1] = 0;
@@ -612,11 +618,17 @@ grub_squash_iterate_dir (grub_fshelp_node_t dir,
 	  if (grub_add (dir->stsize, 1, &sz) ||
 	      grub_mul (sz, sizeof (dir->stack[0]), &sz) ||
 	      grub_add (sz, sizeof (*node), &sz))
-	    return 0;
+	    {
+	      grub_free (buf);
+	      return 0;
+	    }
 
 	  node = grub_malloc (sz);
 	  if (! node)
-	    return 0;
+	    {
+	      grub_free (buf);
+	      return 0;
+	    }
 
 	  grub_memcpy (node, dir, sz - sizeof(dir->stack[0]));
 
-- 
2.28.0.windows.1