[PATCH] xen/gunzip: free the code-length table on an overlong length run

[Stefano Stabellini <stefano.stabellini@xxxxxxx>]

inflate_dynamic() builds a decoding table from the code-length code
lengths of a dynamic block and reads the literal/length and distance
code lengths through it. A run of repeated or zero lengths that would
go past the number of codes the block declares makes it refuse the
block with 1, but that path only frees the list of code lengths: the
table is left allocated, and nothing else frees it.

Free the table before returning on each of the three kinds of run. The
other exits of inflate_dynamic() already free what they built, or are
taken only after error() has stopped Xen.

Fixes: e2b1ebf4de50 ("x86: Support booting a bzImage format domain 0 kernel.")
Signed-off-by: Stefano Stabellini <stefano.stabellini@xxxxxxx>
Cc: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
Cc: Anthony PERARD <anthony.perard@xxxxxxxxxx>
Cc: Michal Orzel <michal.orzel@xxxxxxx>
Cc: Jan Beulich <jbeulich@xxxxxxxx>
Cc: Julien Grall <julien@xxxxxxx>
Cc: Roger Pau Monne <roger@xxxxxxxxxxxxxx>
---
 xen/common/gzip/inflate.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/xen/common/gzip/inflate.c b/xen/common/gzip/inflate.c
index cb146555c8..69bed78a38 100644
--- a/xen/common/gzip/inflate.c
+++ b/xen/common/gzip/inflate.c
@@ -858,6 +858,7 @@ static int noinline __init inflate_dynamic(struct 
gunzip_state *s)
             j = 3 + ((unsigned)b & 3);
             DUMPBITS(2);
             if ((unsigned)i + j > n) {
+                huft_free(tl);
                 ret = 1;
                 goto out;
             }
@@ -870,6 +871,7 @@ static int noinline __init inflate_dynamic(struct 
gunzip_state *s)
             j = 3 + ((unsigned)b & 7);
             DUMPBITS(3);
             if ((unsigned)i + j > n) {
+                huft_free(tl);
                 ret = 1;
                 goto out;
             }
@@ -883,6 +885,7 @@ static int noinline __init inflate_dynamic(struct 
gunzip_state *s)
             j = 11 + ((unsigned)b & 0x7f);
             DUMPBITS(7);
             if ((unsigned)i + j > n) {
+                huft_free(tl);
                 ret = 1;
                 goto out;
             }
-- 
2.47.3