[PATCH 6/8] erofs-utils: lib: fix gzran EOF handling and state leaks

[Yifan Zhao <stopire@gmail.com>]

An initial EOF can produce an invalid inflate input length, and the
state allocated by inflateInit2() is never freed.

Let's reject initial EOF with -EIO and call inflateEnd() on all exits
after successful initialization.

Fixes: 80b2ba447fb0 ("erofs-utils: lib: add gzran virtual file support")
Assisted-by: Codex:gpt-6-astra
Assisted-by: Claude Code:deepseek-v4.1-flash-1017
Signed-off-by: Yifan Zhao <stopire@gmail.com>
---
 lib/gzran.c | 27 +++++++++++++++++----------
 1 file changed, 17 insertions(+), 10 deletions(-)

diff --git a/lib/gzran.c b/lib/gzran.c
index a75756c..dcc4497 100644
--- a/lib/gzran.c
+++ b/lib/gzran.c
@@ -231,7 +231,7 @@ static ssize_t erofs_gzran_ios_vfpread(struct erofs_vfile *vf, void *buf, size_t
 	bool skip = true;
 	u64 inpos, remin;
 	z_stream strm;
-	int ret;
+	ssize_t ret;
 
 	if (offset == ~0ULL) {
 		DBG_BUGON(1);
@@ -257,8 +257,10 @@ static ssize_t erofs_gzran_ios_vfpread(struct erofs_vfile *vf, void *buf, size_t
 	remin -= inpos;
 	ret = erofs_io_pread(ios->vin, src,
 			     min(remin, (u64)sizeof(src)), inpos);
-	if (ret < 0)
-		return ret;
+	if (ret <= 0) {
+		ret = ret < 0 ? ret : -EIO;
+		goto out;
+	}
 	if (u.bits) {
 		inflatePrime(&strm, u.bits, src[0] >> (8 - u.bits));
 		strm.next_in = src + 1;
@@ -294,10 +296,10 @@ static ssize_t erofs_gzran_ios_vfpread(struct erofs_vfile *vf, void *buf, size_t
 				ret = erofs_io_pread(ios->vin, src,
 						     min(remin, (u64)sizeof(src)),
 						     inpos);
-				if (ret < 0)
-					return ret;
-				if (!ret)
-					return -EIO;
+				if (ret <= 0) {
+					ret = ret < 0 ? ret : -EIO;
+					goto out;
+				}
 				inpos += ret;
 				remin -= ret;
 				strm.avail_in = ret;
@@ -306,8 +308,10 @@ static ssize_t erofs_gzran_ios_vfpread(struct erofs_vfile *vf, void *buf, size_t
 			ret = inflate(&strm, Z_NO_FLUSH);       /* normal inflate */
 			if (ret == Z_NEED_DICT)
 				ret = Z_DATA_ERROR;
-			if (ret == Z_MEM_ERROR || ret == Z_DATA_ERROR)
-				return -EIO;
+			if (ret == Z_MEM_ERROR || ret == Z_DATA_ERROR) {
+				ret = -EIO;
+				goto out;
+			}
 			if (ret == Z_STREAM_END)
 				break;
 		} while (strm.avail_out);
@@ -318,7 +322,10 @@ static ssize_t erofs_gzran_ios_vfpread(struct erofs_vfile *vf, void *buf, size_t
 
 		/* do until offset reached and requested data read, or stream ends */
 	} while (skip);
-	return len - strm.avail_out;
+	ret = len - strm.avail_out;
+out:
+	inflateEnd(&strm);
+	return ret;
 }
 
 static struct erofs_vfops erofs_gzran_ios_vfops = {
-- 
2.56.0