gout

commit da343290aeb35f9e9800f67b311402b7d3487279
parent 35b56ab728ff8d1cade8c5eb8d3220060136d8f2
Author: Chris Bracken <chris@bracken.jp>
Date:   Wed, 20 May 2026 22:20:11 +0900

cache: eliminate use-after-free in error bailout

When failing to create the cache output file descriptor/file we free the
path string but then immediately pass the now-invalid pointer to err().
Instead we let the OS free the memory when the process exits on the
err() call.

Diffstat:
M
src/writer/cache/cache.c
 | 
2
--

1 file changed, 0 insertions(+), 2 deletions(-)
diff --git a/src/writer/cache/cache.c b/src/writer/cache/cache.c
@@ -76,7 +76,6 @@ Cache* cache_open(const FileSystem* fs,
   FILE* cache_in = fs->fopen(path, "r");
   int out_fd = fs->mkstemp(temp_cache_path);
   if (out_fd == -1) {
-    free(temp_cache_path);
     if (cache_in) {
       fs->fclose(cache_in);
     }
@@ -85,7 +84,6 @@ Cache* cache_open(const FileSystem* fs,
   FILE* cache_out = fs->fdopen(out_fd, "w");
   if (!cache_out) {
     fs->close(out_fd);
-    free(temp_cache_path);
     if (cache_in) {
       fs->fclose(cache_in);
     }