[PATCH] FIP: don't free the buffer twice when parsing fails

[PATCH] FIP: don't free the buffer twice when parsing fails

[Ahmad Fatoum]

fip_do_parse_buf() hands the buffer to the fip_state before it checks
anything, so fip_free() frees it. fip_parse() freed it on a parse error
as well, and fiptool and the bootm handler call fip_free() afterwards,
which trips over the double free:

  !block_is_free(block) && "block already marked as free"common/tlsf.c 1069

Let's leave freeing the buffer to fip_free().

Fixes: 47d995141515 ("fip: fix wrong function call")
Assisted-by: Claude:opus-5.5
Signed-off-by: Ahmad Fatoum <a.fatoum@barebox.org>
---
 lib/fip.c | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/lib/fip.c b/lib/fip.c
index 9470aa5d3398..7aca217532c5 100644
--- a/lib/fip.c
+++ b/lib/fip.c
@@ -277,12 +277,7 @@ int fip_parse(struct fip_state *fip,
 		return ret;
 	}
 
-	ret = fip_do_parse_buf(fip, buf, size, toc_header_out);
-
-	if (ret)
-		free(buf);
-
-	return ret;
+	return fip_do_parse_buf(fip, buf, size, toc_header_out);
 }
 
 static struct fip_image *fip_read_image_from_file(const uuid_t *uuid, const char *filename)
-- 
2.47.3

Re: [PATCH] FIP: don't free the buffer twice when parsing fails

[Sascha Hauer]

On Sun, 08 Nov 2026 21:15:23 +0100, Ahmad Fatoum wrote:
> fip_do_parse_buf() hands the buffer to the fip_state before it checks
> anything, so fip_free() frees it. fip_parse() freed it on a parse error
> as well, and fiptool and the bootm handler call fip_free() afterwards,
> which trips over the double free:
> 
>   !block_is_free(block) && "block already marked as free"common/tlsf.c 1069
> 
> [...]

Applied, thanks!

[1/1] FIP: don't free the buffer twice when parsing fails
      https://git.pengutronix.de/cgit/barebox/commit/?id=db380db7a860 (link may not be stable)

Best regards,
-- 
Sascha Hauer <s.hauer@pengutronix.de>