inflate_dynamic() builds a decoding table from the code-length code
lengths of a dynamic block and reads the literal/length and distance
code lengths through it. A run of repeated or zero lengths that would
go past the number of codes the block declares makes it refuse the
block with 1, but that path only frees the list of code lengths: the
table is left allocated, and nothing else frees it.

Free the table before returning on each of the three kinds of run. The
other exits of inflate_dynamic() already free what they built, or are
taken only after error() has stopped Xen.

Fixes: e2b1ebf4de50 ("x86: Support booting a bzImage format domain 0 kernel.")
Signed-off-by: Stefano Stabellini <stefano.stabellini@amd.com>
Cc: Andrew Cooper <andrew.cooper3@citrix.com>
Cc: Anthony PERARD <anthony.perard@vates.tech>
Cc: Michal Orzel <michal.orzel@amd.com>
Cc: Jan Beulich <jbeulich@suse.com>
Cc: Julien Grall <julien@xen.org>
Cc: Roger Pau Monne <roger@xenproject.org>
---
 xen/common/gzip/inflate.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/xen/common/gzip/inflate.c b/xen/common/gzip/inflate.c
index cb146555c8..69bed78a38 100644
--- a/xen/common/gzip/inflate.c
+++ b/xen/common/gzip/inflate.c
@@ -858,6 +858,7 @@ static int noinline __init inflate_dynamic(struct gunzip_state *s)
             j = 3 + ((unsigned)b & 3);
             DUMPBITS(2);
             if ((unsigned)i + j > n) {
+                huft_free(tl);
                 ret = 1;
                 goto out;
             }
@@ -870,6 +871,7 @@ static int noinline __init inflate_dynamic(struct gunzip_state *s)
             j = 3 + ((unsigned)b & 7);
             DUMPBITS(3);
             if ((unsigned)i + j > n) {
+                huft_free(tl);
                 ret = 1;
                 goto out;
             }
@@ -883,6 +885,7 @@ static int noinline __init inflate_dynamic(struct gunzip_state *s)
             j = 11 + ((unsigned)b & 0x7f);
             DUMPBITS(7);
             if ((unsigned)i + j > n) {
+                huft_free(tl);
                 ret = 1;
                 goto out;
             }
-- 
2.47.3

On 30.10.2026 20:44, Stefano Stabellini wrote:
> inflate_dynamic() builds a decoding table from the code-length code
> lengths of a dynamic block and reads the literal/length and distance
> code lengths through it. A run of repeated or zero lengths that would
> go past the number of codes the block declares makes it refuse the
> block with 1, but that path only frees the list of code lengths: the
> table is left allocated, and nothing else frees it.
> 
> Free the table before returning on each of the three kinds of run. The
> other exits of inflate_dynamic() already free what they built, or are
> taken only after error() has stopped Xen.
> 
> Fixes: e2b1ebf4de50 ("x86: Support booting a bzImage format domain 0 kernel.")
> Signed-off-by: Stefano Stabellini <stefano.stabellini@amd.com>

Reviewed-by: Jan Beulich <jbeulich@suse.com>

Fiddling with code inherited from Linux isn't nice, but Linux long moved
to a newer zlib baseline. Perhaps we should follow that, by doing a fresh
import.

Jan