From 3da5472266c266a109d365a15ac65ebdfe9b07e9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jean-Fran=C3=A7ois=20DEL=20NERO?=
 <jeanfrancoisdelnero@free.fr>
Date: Sun, 11 Oct 2026 21:27:51 +0200
Subject: [PATCH] CodeQL : Potential use after free & Potential double free
 fix.

---
 libhxcfe/sources/thirdpartylibs/adflib/Lib/adf_bitm.c | 10 ++++++++--
 libhxcfe/sources/thirdpartylibs/adflib/Lib/adf_hd.c   |  7 +++++++
 2 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/libhxcfe/sources/thirdpartylibs/adflib/Lib/adf_bitm.c b/libhxcfe/sources/thirdpartylibs/adflib/Lib/adf_bitm.c
index 90f2eae5..a73cb5d1 100644
--- a/libhxcfe/sources/thirdpartylibs/adflib/Lib/adf_bitm.c
+++ b/libhxcfe/sources/thirdpartylibs/adflib/Lib/adf_bitm.c
@@ -320,13 +320,17 @@ RETCODE adfCreateBitmap(struct Volume *vol)
 	vol->bitmapBlocksChg = (BOOL*) calloc(1,sizeof(BOOL)*mapSize);
     if (!vol->bitmapBlocksChg) {
         free(vol->bitmapTable);
+		vol->bitmapTable = NULL;
         (*adfEnv.eFct)("adfCreateBitmap : malloc, vol->bitmapBlocksChg");
         return RC_MALLOC;
     }
 
 	vol->bitmapBlocks = (SECTNUM*) calloc(1,sizeof(SECTNUM)*mapSize);
     if (!vol->bitmapBlocks) {
-        free(vol->bitmapTable); free(vol->bitmapBlocksChg);
+        free(vol->bitmapTable);
+		vol->bitmapTable = NULL;
+		free(vol->bitmapBlocksChg);
+		vol->bitmapBlocksChg = NULL;
         (*adfEnv.eFct)("adfCreateBitmap : malloc, vol->bitmapBlocks");
         return RC_MALLOC;
     }
@@ -334,10 +338,12 @@ RETCODE adfCreateBitmap(struct Volume *vol)
     for(i=0; i<mapSize; i++) {
         vol->bitmapTable[i] = (struct bBitmapBlock*)calloc(1,sizeof(struct bBitmapBlock));
         if (!vol->bitmapTable[i]) {
-            free(vol->bitmapTable); free(vol->bitmapBlocksChg);
+            free(vol->bitmapBlocksChg);
+			vol->bitmapBlocksChg = NULL;
             for(j=0; j<i; j++) 
                 free(vol->bitmapTable[j]);
             free(vol->bitmapTable);
+			vol->bitmapTable = NULL;
 			(*adfEnv.eFct)("adfCreateBitmap : malloc");
             return RC_MALLOC;
         }
diff --git a/libhxcfe/sources/thirdpartylibs/adflib/Lib/adf_hd.c b/libhxcfe/sources/thirdpartylibs/adflib/Lib/adf_hd.c
index 49ceab95..8d2d4d13 100644
--- a/libhxcfe/sources/thirdpartylibs/adflib/Lib/adf_hd.c
+++ b/libhxcfe/sources/thirdpartylibs/adflib/Lib/adf_hd.c
@@ -638,8 +638,14 @@ RETCODE adfCreateHd(struct Device* dev, int n, struct Partition** partList )
 /* pas fini */
            }
            free(dev->volList);
+           dev->volList = NULL;
+           dev->nVol = 0;
+
            (*adfEnv.eFct)("adfCreateHd : adfCreateVol() fails");
+
+           return RC_ERROR;
         }
+
         dev->volList[i]->blockSize = 512;
     }
     dev->nVol = n;
@@ -651,6 +657,7 @@ printf("0first=%ld last=%ld root=%ld\n",vol->firstBlock,
 
     if (adfCreateHdHeader(dev, n, partList )!=RC_OK)
         return RC_ERROR;
+
     return RC_OK;
 }