Fix double-free of path string on S3 error paths - #30437
Closed
robobun wants to merge 1 commit into
Closed
Claude / Claude Code Review
completed
May 9, 2026 in 16m 46s
Code review found 1 important issue
Found 6 candidates, confirmed 1. See review comments for details.
Details
| Severity | Count |
|---|---|
| 🔴 Important | 1 |
| 🟡 Nit | 0 |
| 🟣 Pre-existing | 0 |
| Severity | File:Line | Issue |
|---|---|---|
| 🔴 Important | src/runtime/webcore/S3Client.zig:156-161 |
path_consumed set too late: double-free still possible if construct fn throws after initS3 |
Annotations
Check failure on line 161 in src/runtime/webcore/S3Client.zig
claude / Claude Code Review
path_consumed set too late: double-free still possible if construct fn throws after initS3
The `path_consumed` flag is set after `constructS3FileWithS3CredentialsAndOptions` returns, but ownership of `path` actually transfers *inside* that function at the `Blob.Store.initS3*` call — and there is still fallible code after it (`try opts.getTruthyComptime(globalObject, "type")` / `try file_type.toSlice(...)`). If that post-`initS3` read throws, `errdefer store.deinit()` frees the store, the error propagates with `path_consumed` still `false`, and the caller's `errdefer` derefs the alread
Loading