Fix bug in gzclose() when gzwrite() runs out of memory.

If the deflateInit2() called for the first gzwrite() failed with a
Z_MEM_ERROR, then a subsequent gzclose() would try to free an
already freed pointer.  This fixes that.

diff --git a/gzwrite.c b/gzwrite.c
index 79a69a5cd2fe3586500f41b856bd42ba8c90ab32..1b06cdd104f85f1b0089a69d0459a82bdb2554a9 100644 (file)
--- a/gzwrite.c
+++ b/gzwrite.c
@@ -556,12 +556,13 @@ int ZEXPORT gzclose_w(file)
     /* flush, free memory, and close file */
     if (gz_comp(state, Z_FINISH) == -1)
         ret = state->err;
-    if (!state->direct) {
-        (void)deflateEnd(&(state->strm));
-        free(state->out);
-    }
-    if (state->size)
+    if (state->size) {
+        if (!state->direct) {
+            (void)deflateEnd(&(state->strm));
+            free(state->out);
+        }
         free(state->in);
+    }
     gz_error(state, Z_OK, NULL);
     free(state->path);
     if (close(state->fd) == -1)