Fix memory leak of old curr_reg on san_bump_grow_locked failure

When san_bump_grow_locked fails, it sets sba->curr_reg to NULL.
The old curr_reg (saved in to_destroy) was never freed or restored,
leaking the virtual memory extent. Restore sba->curr_reg from
to_destroy on failure so the old region remains usable.
This commit is contained in:
Slobodan Predolac 2026-03-27 10:07:05 -07:00
parent 69b3de282b
commit 19057b92e4
2 changed files with 89 additions and 1 deletions

View file

@ -31,6 +31,7 @@ san_bump_alloc(tsdn_t *tsdn, san_bump_alloc_t *sba, pac_t *pac,
bool err = san_bump_grow_locked(
tsdn, sba, pac, ehooks, guarded_size);
if (err) {
sba->curr_reg = to_destroy;
goto label_err;
}
} else {