commit f9e9269513c7ee687c46d6060a784a9ca11646ce
from: Omar Polo <op@omarpolo.com>
date: Mon Feb 26 16:09:07 2024 UTC

fix invalid imsg_free() in got_privsep_recv_printed_commits()

Depending on the error got_privsep_recv_imsg() may leave imsg
un-initialized, so change it to always free the imsg on error if
needed, so callers don't have to.

got_privsep_recv_printed_commits() and got-read-patch were the only
places where we could end up calling imsg_free() on uninitialized
imsg, fix them.

ok stsp@

commit - 7a86002db34d49472a7d75c1802ee99c2120ef3c
commit + f9e9269513c7ee687c46d6060a784a9ca11646ce
blob - 79db43c49ad84782e167cf267f4958c7fa944561
blob + 208f38064847db1bdf2043d22f6be5691d0905c1
--- lib/privsep.c
+++ lib/privsep.c
@@ -141,12 +141,16 @@ got_privsep_recv_imsg(struct imsg *imsg, struct imsgbu
 			return got_error_from_errno("imsg_get");
 	}
 
-	if (imsg->hdr.len < IMSG_HEADER_SIZE + min_datalen)
+	if (imsg->hdr.len < IMSG_HEADER_SIZE + min_datalen) {
+		imsg_free(imsg);
 		return got_error(GOT_ERR_PRIVSEP_LEN);
+	}
 
 	if (imsg->hdr.type == GOT_IMSG_ERROR) {
 		size_t datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
-		return recv_imsg_error(imsg, datalen);
+		err = recv_imsg_error(imsg, datalen);
+		imsg_free(imsg);
+		return err;
 	}
 
 	return NULL;
@@ -3510,10 +3514,8 @@ got_privsep_recv_painted_commits(struct got_object_id_
 
 	for (;;) {
 		err = got_privsep_recv_imsg(&imsg, ibuf, 0);
-		if (err){
-			imsg_free(&imsg);
+		if (err)
 			return err;
-		}
 
 		datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
 		if (imsg.hdr.type == GOT_IMSG_COMMIT_PAINTING_DONE) {
blob - 508821d598050b15d1b623785750f1a0c1040d10
blob + 83d8af428815b7ef730a8ddf19a89a8505a9bd60
--- libexec/got-read-patch/got-read-patch.c
+++ libexec/got-read-patch/got-read-patch.c
@@ -682,8 +682,8 @@ main(int argc, char **argv)
 		goto done;
 	}
 	err = got_privsep_flush_imsg(&ibuf);
-done:
 	imsg_free(&imsg);
+done:
 	if (fd != -1 && close(fd) == -1 && err == NULL)
 		err = got_error_from_errno("close");
 	if (fp != NULL && fclose(fp) == EOF && err == NULL)