From 69005960aae0b7b1ef91359ec66fa83d0fe9d1ee Mon Sep 17 00:00:00 2001 From: Song Date: Wed, 6 May 2026 13:56:27 +0000 Subject: [PATCH] fix: free leaked vorbis_info/vorbis_comment on recursive error unwind MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fixes #125. _bisect_forward_serialno() parses intermediate link headers into local temporaries (vorbis_info, vorbis_comment, next_serialno_list) via _fetch_headers(). When a deeper recursive call fails, the early return exits without freeing those locals — leaking ~27 KB per invocation on crafted multi-stream Ogg files. Two-site fix in lib/vorbisfile.c: 1. _bisect_forward_serialno() recursive error path: add vorbis_info_clear/vorbis_comment_clear/_ogg_free before return. 2. _fetch_headers() bail path: free *serialno_list when present. --- lib/vorbisfile.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/lib/vorbisfile.c b/lib/vorbisfile.c index adce8fea..92376688 100644 --- a/lib/vorbisfile.c +++ b/lib/vorbisfile.c @@ -410,6 +410,11 @@ static int _fetch_headers(OggVorbis_File *vf,vorbis_info *vi,vorbis_comment *vc, } bail_header: + if(serialno_list && *serialno_list){ + _ogg_free(*serialno_list); + *serialno_list=NULL; + if(serialno_n)*serialno_n=0; + } vorbis_info_clear(vi); vorbis_comment_clear(vc); vf->ready_state=OPENED; @@ -579,7 +584,12 @@ static int _bisect_forward_serialno(OggVorbis_File *vf, ret=_bisect_forward_serialno(vf,next,vf->offset,end,endgran,endserial, next_serialno_list,next_serialnos,m+1); - if(ret)return(ret); + if(ret){ + vorbis_info_clear(&vi); + vorbis_comment_clear(&vc); + if(next_serialno_list)_ogg_free(next_serialno_list); + return(ret); + } if(next_serialno_list)_ogg_free(next_serialno_list);