From e8088c3b52b875b75930a7f9b677afd864ec62f1 Mon Sep 17 00:00:00 2001 From: "Gabriel A. Devenyi" Date: Sat, 15 Aug 2026 01:18:16 -0400 Subject: [PATCH] BUG: Free the extension data when nifti_add_extension fails act_add_exts() in both nifti_tool and nifti1_tool reads the extension data from a file into edata and, if nifti_add_extension() then fails, returns without freeing it. The success path a few lines below frees it already. Found by clang's static analyzer, on a path the test suite does not reach. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01KSPnbwpDjVcAYqDdVqLkMU --- nifti2/nifti_tool.c | 1 + niftilib/nifti1_tool.c | 1 + 2 files changed, 2 insertions(+) diff --git a/nifti2/nifti_tool.c b/nifti2/nifti_tool.c index ac249bf8..4af13d38 100644 --- a/nifti2/nifti_tool.c +++ b/nifti2/nifti_tool.c @@ -2284,6 +2284,7 @@ int act_add_exts( nt_opts * opts ) opts->etypes.list[ec]); if( nifti_add_extension(nim, ext, elen, opts->etypes.list[ec]) ){ + free(edata); /* may hold the file contents read just above */ nifti_image_free(nim); return 1; } diff --git a/niftilib/nifti1_tool.c b/niftilib/nifti1_tool.c index 15bb165a..c9344a7f 100644 --- a/niftilib/nifti1_tool.c +++ b/niftilib/nifti1_tool.c @@ -1865,6 +1865,7 @@ int act_add_exts( nt_opts * opts ) } if( nifti_add_extension(nim, ext, elen, opts->etypes.list[ec]) ){ + free(edata); /* may hold the file contents read just above */ nifti_image_free(nim); return 1; }