Subject: Possible use after free in w32notify.c

From: Stefan Kangas <[email-masked]>
Date: Sat, 13 Jan 2024 01:49:36 -0600

Could someone familiar with w32notify.c look over the attached patch?

It looks like we are trying to dereference NULL in add_watch, and
returning an already freed value from start_watching.
diff --git a/src/w32notify.c b/src/w32notify.c
index 9f8a62a1daa..c93e8796fe2 100644
--- a/src/w32notify.c
+++ b/src/w32notify.c
@@ -350,6 +350,7 @@ start_watching (const char *file, HANDLE hdir, BOOL subdirs, DWORD flags)
       xfree (dirwatch->io_info);
       xfree (dirwatch->watchee);
       xfree (dirwatch);
+      return NULL;
     }
   return dirwatch;
 }
@@ -412,10 +413,7 @@ add_watch (const char *parent_dir, const char *file, BOOL subdirs, DWORD flags)
     return NULL;
 
   if ((dirwatch = start_watching (file, hdir, subdirs, flags)) == NULL)
-    {
-      CloseHandle (hdir);
-      dirwatch->dir = NULL;
-    }
+    CloseHandle (hdir);
 
   return dirwatch;
 }