Commit f963dc2d9 for clamav.net

commit f963dc2d9e2a3847df7502b42b8f30da08323708
Author: Val S. <micasnyd@cisco.com>
Date:   Mon Jun 30 10:47:20 2025 -0400

    Fix lzma-sdk xz bug (#1521)

    A use-after-free read is possible in the Xz decoder cleanup.

    The fix is to set a pointer to NULL so it doesn't try to
    dereference it and free a second time.

    Fixes https://issues.oss-fuzz.com/issues/384549094

    This fix is also present in lzma-sdk version 18.01.
    Ref: https://github.com/welovegit/LZMA-SDK/blame/main/C/XzDec.c#L508

diff --git a/libclamav/7z/XzDec.c b/libclamav/7z/XzDec.c
index 00a28702f..7e40d202f 100644
--- a/libclamav/7z/XzDec.c
+++ b/libclamav/7z/XzDec.c
@@ -343,8 +343,10 @@ void MixCoder_Free(CMixCoder *p)
   for (i = 0; i < p->numCoders; i++)
   {
     IStateCoder *sc = &p->coders[i];
-    if (p->alloc && sc->p)
+    if (p->alloc && sc->p) {
       sc->Free(sc->p, p->alloc);
+      sc->p = NULL;
+    }
   }
   p->numCoders = 0;
   if (p->buf)