Commit fe4d763d for xz
commit fe4d763d566a38ad61d4c5022520c25578a3a464
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Wed Sep 9 14:14:40 2026 +0300
liblzma: Make lzma_lz_decoder_init() safe to reinit after alloc failure
If memory allocation fails and the resulting coder state is reused,
ensure that memory allocation is attempted again. However, coders that
are initialized via lzma_next_filter_init() shouldn't be reinitialized
after failure; they should be cleaned up with lzma_next_end().
Reported-by: GitHub user christos-cantina-security (christos-spearbit)
diff --git a/src/liblzma/lz/lz_decoder.c b/src/liblzma/lz/lz_decoder.c
index 1cb120ab..6dc4cefb 100644
--- a/src/liblzma/lz/lz_decoder.c
+++ b/src/liblzma/lz/lz_decoder.c
@@ -278,6 +278,7 @@ lzma_lz_decoder_init(lzma_next_coder *next, const lzma_allocator *allocator,
// Allocate and initialize the dictionary.
if (coder->dict.size != alloc_size) {
+ coder->dict.size = 0;
lzma_free(coder->dict.buf, allocator);
// The LZ_DICT_EXTRA bytes at the end of the buffer aren't