From 708ac9f76da507751dd6d80e240e47b74fe9a1b8 Mon Sep 17 00:00:00 2001
From: Sami Kortelainen
Date: Tue, 29 Sep 2026 14:54:21 +0300
Subject: Fixed memory handling. Fixed to release mutex on error. Fixed
 use-after-free on ipsw zip.

---
 src/dfu.c  | 3 ++-
 src/ipsw.c | 8 +++++---
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/src/dfu.c b/src/dfu.c
index 6ba23e7..af62e87 100644
--- a/src/dfu.c
+++ b/src/dfu.c
@@ -47,11 +47,11 @@ int dfu_client_new(struct idevicerestore_client_t* client)
 
 	if (client->dfu == NULL) {
 		client->dfu = (struct dfu_client_t*)malloc(sizeof(struct dfu_client_t));
-		memset(client->dfu, 0, sizeof(struct dfu_client_t));
 		if (client->dfu == NULL) {
 			logger(LL_ERROR, "Out of memory\n");
 			return -1;
 		}
+		memset(client->dfu, 0, sizeof(struct dfu_client_t));
 	}
 
 	if (irecv_open_with_ecid_and_attempts(&dfu, client->ecid, 10) != IRECV_E_SUCCESS) {
@@ -461,6 +461,7 @@ int dfu_enter_recovery(struct idevicerestore_client_t* client, plist_t build_ide
 	mutex_lock(&client->device_event_mutex);
 
 	if (dfu_send_component(client, build_identity, "iBSS") < 0) {
+		mutex_unlock(&client->device_event_mutex);
 		logger(LL_ERROR, "Unable to send iBSS to device\n");
 		irecv_close(client->dfu->client);
 		client->dfu->client = NULL;
diff --git a/src/ipsw.c b/src/ipsw.c
index cebfa49..9eeaab1 100644
--- a/src/ipsw.c
+++ b/src/ipsw.c
@@ -683,13 +683,15 @@ int ipsw_extract_to_memory(ipsw_archive_t ipsw, const char* infile, void** pbuff
 		}
 
 		zip_int64_t zr = zip_fread(zfile, buffer, size);
+		int zep = 0;
+		int sep = 0;
+		if (zr < 0) {
+			zip_file_error_get(zfile, &zep, &sep);
+		}
 		zip_fclose(zfile);
 		zip_unchange_all(zip);
 		zip_close(zip);
 		if (zr < 0) {
-			int zep = 0;
-			int sep = 0;
-			zip_file_error_get(zfile, &zep, &sep);
 			logger(LL_ERROR, "zip_fread: %s %d %d\n", infile, zep, sep);
 			free(buffer);
 			return -1;
-- 
cgit v1.1-32-gdbae