Commit ea1a724 for zlib

commit ea1a724e7f9052a4c51212e228104a1f4fadc611
Author: ronald.eytchison@trailofbits.com <ronald.eytchison@trailofbits.com>
Date:   Fri Jun 5 19:10:15 2026 +0000

    Free Turbo C allocation when pointer table is full.

    Wow, this code is Precambrian. We'll harden it anyway.

    Reported by Trail of Bits (TOB-ZLIB-010).

diff --git a/zutil.c b/zutil.c
index 0e30c56..6c01021 100644
--- a/zutil.c
+++ b/zutil.c
@@ -227,7 +227,11 @@ voidpf ZLIB_INTERNAL zcalloc(voidpf opaque, unsigned items, unsigned size) {
     } else {
         buf = farmalloc(bsize + 16L);
     }
-    if (buf == NULL || next_ptr >= MAX_PTR) return NULL;
+    if (buf == NULL) return NULL;
+    if (next_ptr >= MAX_PTR) {
+        farfree(buf);
+        return NULL;
+    }
     table[next_ptr].org_ptr = buf;

     /* Normalize the pointer to seg:0 */