It is possible for the if statement to never succeed, causing path to never be freed. It is also possible for the if statement to succeed more than once per loop, which could have caused a segfault. Signed-off-by: Nathan Jones <nathanj@insightbb.com> --- lib/libalpm/delta.c | 6 ++++-- 1 files changed, 4 insertions(+), 2 deletions(-) diff --git a/lib/libalpm/delta.c b/lib/libalpm/delta.c index 8daac0c..b59dd52 100644 --- a/lib/libalpm/delta.c +++ b/lib/libalpm/delta.c @@ -170,15 +170,15 @@ static alpm_list_t *shortest_delta_path(alpm_list_t *deltas, /* If this vertex has already been visited in the path, go to the * next vertex. */ - if(alpm_list_find_ptr(path, v)) + if(alpm_list_find_ptr(path, v)) { continue; + } /* Once we find a vertex that starts at the 'from' version, * recursively find the shortest path using the 'to' version of this * current vertex as the 'from' version in the function call. */ if(strcmp(v->from, from) == 0) { alpm_list_t *newpath = alpm_list_copy(path); - alpm_list_free(path); newpath = alpm_list_add(newpath, v); newpath = shortest_delta_path(deltas, v->to, to, newpath); @@ -197,6 +197,8 @@ static alpm_list_t *shortest_delta_path(alpm_list_t *deltas, } } + alpm_list_free(path); + return(shortest); } -- 1.5.3.7