From 0058d4162c49c0dc0d3d3fa12266500bdad511e8 Mon Sep 17 00:00:00 2001 From: Sven Verdoolaege Date: Sat, 7 Aug 2010 13:47:57 +0200 Subject: [PATCH] isl_input.c: read_factor: fix read after free in error path Signed-off-by: Sven Verdoolaege --- isl_input.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/isl_input.c b/isl_input.c index 21d53ba..101f0a9 100644 --- a/isl_input.c +++ b/isl_input.c @@ -1242,13 +1242,16 @@ static __isl_give isl_qpolynomial *read_factor(struct isl_stream *s, int n = v->n; int pos = vars_pos(v, tok->u.s, -1); int pow; - isl_token_free(tok); - if (pos < 0) - goto error; + if (pos < 0) { + isl_token_free(tok); + return NULL; + } if (pos >= n) { isl_stream_error(s, tok, "unknown identifier"); + isl_token_free(tok); return NULL; } + isl_token_free(tok); pow = optional_power(s); qp = isl_qpolynomial_pow(isl_basic_map_get_dim(bmap), pos, pow); } else if (tok->type == '[') { -- 2.7.4