From 708ac9f76da507751dd6d80e240e47b74fe9a1b8 Mon Sep 17 00:00:00 2001
From: Sami Kortelainen
Date: Tue, 29 Sep 2026 14:54:21 +0300
Subject: Fixed memory handling. Fixed to release mutex on error. Fixed
 use-after-free on ipsw zip.

---
 src/dfu.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

(limited to 'src/dfu.c')

diff --git a/src/dfu.c b/src/dfu.c
index 6ba23e7..af62e87 100644
--- a/src/dfu.c
+++ b/src/dfu.c
@@ -47,11 +47,11 @@ int dfu_client_new(struct idevicerestore_client_t* client)
 
 	if (client->dfu == NULL) {
 		client->dfu = (struct dfu_client_t*)malloc(sizeof(struct dfu_client_t));
-		memset(client->dfu, 0, sizeof(struct dfu_client_t));
 		if (client->dfu == NULL) {
 			logger(LL_ERROR, "Out of memory\n");
 			return -1;
 		}
+		memset(client->dfu, 0, sizeof(struct dfu_client_t));
 	}
 
 	if (irecv_open_with_ecid_and_attempts(&dfu, client->ecid, 10) != IRECV_E_SUCCESS) {
@@ -461,6 +461,7 @@ int dfu_enter_recovery(struct idevicerestore_client_t* client, plist_t build_ide
 	mutex_lock(&client->device_event_mutex);
 
 	if (dfu_send_component(client, build_identity, "iBSS") < 0) {
+		mutex_unlock(&client->device_event_mutex);
 		logger(LL_ERROR, "Unable to send iBSS to device\n");
 		irecv_close(client->dfu->client);
 		client->dfu->client = NULL;
-- 
cgit v1.1-32-gdbae