From 18ae8d6deda99d9f5bf5d372c27a72f95d1f7948 Mon Sep 17 00:00:00 2001 From: Mikhail Dmitrichenko Date: Tue, 5 May 2026 17:19:25 +0300 Subject: dir.c: fix dirent leak on glob_opendir realloc failure In glob_opendir(), each directory entry is copied before the entries array is grown. If growing ent->sort.entries fails, the function jumps to the nomem label before the copied entry is stored in the array. glob_dir_finish() only frees entries already recorded in ent->sort.entries, so the current rdp is leaked on that error path. Free rdp before jumping to nomem. Signed-off-by: Mikhail Dmitrichenko --- dir.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/dir.c b/dir.c index d81ae28ee9..9f2d36b633 100644 --- a/dir.c +++ b/dir.c @@ -2803,8 +2803,10 @@ glob_opendir(ruby_glob_entries_t *ent, DIR *dirp, int flags, rb_encoding *enc) } if (count >= capacity) { capacity += 256; - if (!(newp = GLOB_REALLOC_N(ent->sort.entries, capacity))) + if (!(newp = GLOB_REALLOC_N(ent->sort.entries, capacity))) { + GLOB_FREE(rdp); goto nomem; + } ent->sort.entries = newp; } ent->sort.entries[count++] = rdp; -- cgit v1.2.3