[PATCH] FIP: don't free the buffer twice when parsing fails

[Ahmad Fatoum <a.fatoum@barebox.org>]

fip_do_parse_buf() hands the buffer to the fip_state before it checks
anything, so fip_free() frees it. fip_parse() freed it on a parse error
as well, and fiptool and the bootm handler call fip_free() afterwards,
which trips over the double free:

  !block_is_free(block) && "block already marked as free"common/tlsf.c 1069

Let's leave freeing the buffer to fip_free().

Fixes: 47d995141515 ("fip: fix wrong function call")
Assisted-by: Claude:opus-5.5
Signed-off-by: Ahmad Fatoum <a.fatoum@barebox.org>
---
 lib/fip.c | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/lib/fip.c b/lib/fip.c
index 9470aa5d3398..7aca217532c5 100644
--- a/lib/fip.c
+++ b/lib/fip.c
@@ -277,12 +277,7 @@ int fip_parse(struct fip_state *fip,
 		return ret;
 	}
 
-	ret = fip_do_parse_buf(fip, buf, size, toc_header_out);
-
-	if (ret)
-		free(buf);
-
-	return ret;
+	return fip_do_parse_buf(fip, buf, size, toc_header_out);
 }
 
 static struct fip_image *fip_read_image_from_file(const uuid_t *uuid, const char *filename)
-- 
2.47.3