bug#68421: Possible use after free in w32notify.c

[Stefan Kangas <stefankangas@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 191 bytes --]

Could someone familiar with w32notify.c look over the attached patch?

It looks like we are trying to dereference NULL in add_watch, and
returning an already freed value from start_watching.

[-- Attachment #2: w32notify-ub.diff --]
[-- Type: text/x-diff, Size: 680 bytes --]

diff --git a/src/w32notify.c b/src/w32notify.c
index 9f8a62a1daa..c93e8796fe2 100644
--- a/src/w32notify.c
+++ b/src/w32notify.c
@@ -350,6 +350,7 @@ start_watching (const char *file, HANDLE hdir, BOOL subdirs, DWORD flags)
       xfree (dirwatch->io_info);
       xfree (dirwatch->watchee);
       xfree (dirwatch);
+      return NULL;
     }
   return dirwatch;
 }
@@ -412,10 +413,7 @@ add_watch (const char *parent_dir, const char *file, BOOL subdirs, DWORD flags)
     return NULL;
 
   if ((dirwatch = start_watching (file, hdir, subdirs, flags)) == NULL)
-    {
-      CloseHandle (hdir);
-      dirwatch->dir = NULL;
-    }
+    CloseHandle (hdir);
 
   return dirwatch;
 }