isl_tab_rollback: avoid double free on error path

[platform/upstream/isl.git] / isl_tab.c

diff --git a/isl_tab.c b/isl_tab.c
index 5eafec4..b8a80be 100644 (file)
--- a/isl_tab.c
+++ b/isl_tab.c
@@ -312,6 +312,8 @@ static struct isl_mat *tab_mat_product(struct isl_mat *mat1,
 
        prod = isl_mat_alloc(mat1->ctx, mat1->n_row + mat2->n_row,
                                        off + col1 + col2);
+       if (!prod)
+               return NULL;
 
        n = 0;
        for (i = 0; i < r1; ++i) {
@@ -3028,6 +3030,7 @@ int isl_tab_rollback(struct isl_tab *tab, struct isl_tab_undo *snap)
                if (undo == snap)
                        break;
                if (perform_undo(tab, undo) < 0) {
+                       tab->top = undo;
                        free_undo(tab);
                        tab->in_undo = 0;
                        return -1;