Fixed memory handling. Fixed to release mutex on error. Fixed use-after-free on ipsw zip.

1 files changed, 2 insertions, 1 deletions

diff --git a/src/dfu.c b/src/dfu.c
index 6ba23e7..af62e87 100644
--- a/src/dfu.c
+++ b/src/dfu.c
@@ -47,11 +47,11 @@ int dfu_client_new(struct idevicerestore_client_t* client)
 
 	if (client->dfu == NULL) {
 		client->dfu = (struct dfu_client_t*)malloc(sizeof(struct dfu_client_t));
-		memset(client->dfu, 0, sizeof(struct dfu_client_t));
 		if (client->dfu == NULL) {
 			logger(LL_ERROR, "Out of memory\n");
 			return -1;
 		}
+		memset(client->dfu, 0, sizeof(struct dfu_client_t));
 	}
 
 	if (irecv_open_with_ecid_and_attempts(&dfu, client->ecid, 10) != IRECV_E_SUCCESS) {
@@ -461,6 +461,7 @@ int dfu_enter_recovery(struct idevicerestore_client_t* client, plist_t build_ide
 	mutex_lock(&client->device_event_mutex);
 
 	if (dfu_send_component(client, build_identity, "iBSS") < 0) {
+		mutex_unlock(&client->device_event_mutex);
 		logger(LL_ERROR, "Unable to send iBSS to device\n");
 		irecv_close(client->dfu->client);
 		client->dfu->client = NULL;