Fix some zlib memory leaks, originally from Mark Adler

2 files changed, 15 insertions, 4 deletions

diff --git a/sys/lib/libz/infblock.c b/sys/lib/libz/infblock.c
index d3d3bb8e347..df9eb431f51 100644
--- a/sys/lib/libz/infblock.c
+++ b/sys/lib/libz/infblock.c
@@ -246,10 +246,12 @@ int r;
                              &s->sub.trees.tb, s->hufts, z);
       if (t != Z_OK)
       {
-        ZFREE(z, s->sub.trees.blens);
         r = t;
         if (r == Z_DATA_ERROR)
+        {
+          ZFREE(z, s->sub.trees.blens);
           s->mode = BAD;
+        }
         LEAVE
       }
       s->sub.trees.index = 0;
@@ -310,11 +312,13 @@ int r;
         t = inflate_trees_dynamic(257 + (t & 0x1f), 1 + ((t >> 5) & 0x1f),
                                   s->sub.trees.blens, &bl, &bd, &tl, &td,
                                   s->hufts, z);
-        ZFREE(z, s->sub.trees.blens);
         if (t != Z_OK)
         {
           if (t == (uInt)Z_DATA_ERROR)
+          {
+            ZFREE(z, s->sub.trees.blens);
             s->mode = BAD;
+          }
           r = t;
           LEAVE
         }
@@ -326,6 +330,7 @@ int r;
         }
         s->sub.decode.codes = c;
       }
+      ZFREE(z, s->sub.trees.blens);
       s->mode = CODES;
     case CODES:
       UPDATE
diff --git a/sys/net/zlib.c b/sys/net/zlib.c
index 1a21e49fb74..682302a928e 100644
--- a/sys/net/zlib.c
+++ b/sys/net/zlib.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: zlib.c,v 1.9 2001/01/29 06:12:11 mickey Exp $	*/
+/*	$OpenBSD: zlib.c,v 1.10 2002/01/18 21:48:35 millert Exp $	*/
 /*	$NetBSD: zlib.c,v 1.2 1996/03/16 23:55:40 christos Exp $	*/
 
 /*
@@ -3405,7 +3405,10 @@ int r;
       {
         r = t;
         if (r == Z_DATA_ERROR)
+        {
+          ZFREE(z, s->sub.trees.blens, s->sub.trees.nblens * sizeof(uInt));
           s->mode = BADB;
+        }
         LEAVE
       }
       s->sub.trees.index = 0;
@@ -3468,7 +3471,10 @@ int r;
         if (t != Z_OK)
         {
           if (t == (uInt)Z_DATA_ERROR)
+          {
+            ZFREE(z, s->sub.trees.blens, s->sub.trees.nblens * sizeof(uInt));
             s->mode = BADB;
+          }
           r = t;
           LEAVE
         }
@@ -3480,11 +3486,11 @@ int r;
           r = Z_MEM_ERROR;
           LEAVE
         }
-        ZFREE(z, s->sub.trees.blens, s->sub.trees.nblens * sizeof(uInt));
         s->sub.decode.codes = c;
         s->sub.decode.tl = tl;
         s->sub.decode.td = td;
       }
+      ZFREE(z, s->sub.trees.blens, s->sub.trees.nblens * sizeof(uInt));
       s->mode = CODES;
     case CODES:
       UPDATE