isl_tab_rollback: avoid double free on error path

[platform/upstream/isl.git] / isl_tab.c

diff --git a/isl_tab.c b/isl_tab.c
index 3b2d90a..b8a80be 100644 (file)
--- a/isl_tab.c
+++ b/isl_tab.c
@@ -87,11 +87,13 @@ error:
 
 int isl_tab_extend_cons(struct isl_tab *tab, unsigned n_new)
 {
-       unsigned off = 2 + tab->M;
+       unsigned off;
 
        if (!tab)
                return -1;
 
+       off = 2 + tab->M;
+
        if (tab->max_con < tab->n_con + n_new) {
                struct isl_tab_var *con;
 
@@ -310,6 +312,8 @@ static struct isl_mat *tab_mat_product(struct isl_mat *mat1,
 
        prod = isl_mat_alloc(mat1->ctx, mat1->n_row + mat2->n_row,
                                        off + col1 + col2);
+       if (!prod)
+               return NULL;
 
        n = 0;
        for (i = 0; i < r1; ++i) {
@@ -3026,6 +3030,7 @@ int isl_tab_rollback(struct isl_tab *tab, struct isl_tab_undo *snap)
                if (undo == snap)
                        break;
                if (perform_undo(tab, undo) < 0) {
+                       tab->top = undo;
                        free_undo(tab);
                        tab->in_undo = 0;
                        return -1;