Found using oss-fuzz, see https://github.com/google/oss-fuzz/pull/1310
Function handle_compressed in g10/compress.c allocates and apparently never frees memory
Here is the code with my added comments
//memory allocated cfx = xmalloc_clear (sizeof *cfx); cfx->release = release_context; cfx->algo = cd->algorithm; // cdx can be copied in a cd->buf field push_compress_filter(cd->buf,cfx,cd->algorithm); if( callback ) rc = callback(cd->buf, passthru ); else rc = proc_packets (ctrl,procctx, cd->buf); //cd->buf goes out of scope cd->buf = NULL; //patch should be xfree(cfx); return rc;
Maybe I am wrong, but there is at least a leak with case COMPRESS_ALGO_NONE