git: 274236ed084a - main - rtld.c: avoid double-free on dso load failure in do_load_object()

The branch main has been updated by kib:

URL: https://cgit.FreeBSD.org/src/commit/?id=274236ed084a259a0e8a11df1afebd2f2f1fb097

commit 274236ed084a259a0e8a11df1afebd2f2f1fb097
Author:     Konstantin Belousov <kib@FreeBSD.org>
AuthorDate: 2026-10-06 08:22:21 +0000
Commit:     Konstantin Belousov <kib@FreeBSD.org>
CommitDate: 2026-10-06 17:33:27 +0000

    rtld.c: avoid double-free on dso load failure in do_load_object()
    
    The obj->path is assigned directly from the path argument, and
    load_object() frees the path on do_load_object() failure.  Do not free
    it in obj_free() on the error path.
    
    Reviewed by:    markj
    Sponsored by:   The FreeBSD Foundation
    MFC after:      1 week
    Differential revision:  https://reviews.freebsd.org/D60402
---
 libexec/rtld-elf/rtld.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/libexec/rtld-elf/rtld.c b/libexec/rtld-elf/rtld.c
index 850e017a404d..048cc473305a 100644
--- a/libexec/rtld-elf/rtld.c
+++ b/libexec/rtld-elf/rtld.c
@@ -3027,6 +3027,7 @@ do_load_object(int fd, const char *name, char *path, struct stat *sbp,
 
 errp:
 	munmap(obj->mapbase, obj->mapsize);
+	obj->path = NULL;	/* obj->path is owned and freed by caller */
 	obj_free(obj);
 	return (NULL);
 }