commit cfc8922bd7eff82e98dcc2d45945769a1a76806c
from: Florian Obser <florian@narrans.de>
via: Thomas Adam <thomas@xteddy.org>
date: Thu Jul 21 08:32:00 2022 UTC

Make sure got_repo_pack_fds_close() frees a malloc'ed pointer.

Found by llvm's scan-build (bad free).
OK stsp

commit - dee47c8728048405c6839bfbb055e2a53c169fd9
commit + cfc8922bd7eff82e98dcc2d45945769a1a76806c
blob - 847387d2ceeaf787c46ee855838863d661357a96
blob + d304ccb5060255fda421740524533ded15185934
--- lib/repository.c
+++ lib/repository.c
@@ -247,11 +247,16 @@ const struct got_error *
 got_repo_pack_fds_open(int **pack_fds)
 {
 	const struct got_error *err = NULL;
-	int i, pack_fds_tmp[GOT_PACK_NUM_TEMPFILES];
+	int i, *pack_fds_tmp;
 
+	pack_fds_tmp = calloc(GOT_PACK_NUM_TEMPFILES, sizeof(int));
+	if (pack_fds_tmp == NULL)
+		return got_error_from_errno("calloc");
 	*pack_fds = calloc(GOT_PACK_NUM_TEMPFILES, sizeof(**pack_fds));
-	if (*pack_fds == NULL)
+	if (*pack_fds == NULL) {
+		free(pack_fds_tmp);
 		return got_error_from_errno("calloc");
+	}
 
 	for (i = 0; i < GOT_PACK_NUM_TEMPFILES; i++) {
 		pack_fds_tmp[i] = got_opentempfd();
@@ -261,7 +266,7 @@ got_repo_pack_fds_open(int **pack_fds)
 			return err;
 		}
 	}
-	memcpy(*pack_fds, pack_fds_tmp, sizeof(pack_fds_tmp));
+	memcpy(*pack_fds, pack_fds_tmp, GOT_PACK_NUM_TEMPFILES * sizeof(int));
 	return err;
 }