[PATCH] regcomp: fix double free in parse_bracket_exp()

[Anastasia Belova]

Double free happens when work_tree = NULL: before the check
and after parse_bracket_exp_free_return free_charset() is called.
Move first call after the check and goto.

Signed-off-by: Anastasia Belova <abelova@astralinux.ru>
---
 posix/regcomp.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/posix/regcomp.c b/posix/regcomp.c
index 32043e9d37..9b8429cece 100644
--- a/posix/regcomp.c
+++ b/posix/regcomp.c
@@ -3385,15 +3385,15 @@ parse_bracket_exp (re_string_t *regexp, re_dfa_t *dfa, re_token_t *token,
   else
 #endif /* not RE_ENABLE_I18N */
     {
-#ifdef RE_ENABLE_I18N
-      free_charset (mbcset);
-#endif
       /* Build a tree for simple bracket.  */
       br_token.type = SIMPLE_BRACKET;
       br_token.opr.sbcset = sbcset;
       work_tree = create_token_tree (dfa, NULL, NULL, &br_token);
       if (__glibc_unlikely (work_tree == NULL))
 	goto parse_bracket_exp_espace;
+#ifdef RE_ENABLE_I18N
+      free_charset (mbcset);
+#endif
     }
   return work_tree;
 
-- 
2.43.0