Fix double-free in parseDirectoryEntries on malformed dir entries

Directory entries registered both an outer errdefer and an inner defer
against the same full_name allocation. When the recursive parse hit an
error (e.g. Truncated), both fired and freed the same pointer twice,
causing SIGABRT/SIGSEGV on malformed CPT archives. Found by validate's
--test-coverage stress run (exit 134 on corrupted sample.cpt).

Fix: hoist the defer/errdefer into the specific branch that owns the
allocation. Dir entries use a single defer (success continue and error
unwind both free exactly once); file entries use errdefer (ownership
transfers to the accumulator on successful append).

Regression test crafts a minimal archive with a non-empty directory
name whose recursive child is truncated, which std.testing.allocator
detects as a double-free under the unfixed code.

Author: Peter Marreck

src/core.zig

@@ -215,18 +215,24 @@ fn parseDirectoryEntries(
 		const is_dir = (name_len_kind & 0x80) != 0;
 		const name_part = try reader.readSlice(name_len);
 		const full_name = try joinPath(allocator, prefix, name_part);
-		errdefer allocator.free(full_name);
 
 		if (is_dir) {
+			// Directory entries: full_name is only consumed as the recursion prefix.
+			// A single `defer` frees on every exit (success continue and error unwind),
+			// avoiding the double-free that an outer errdefer + inner defer would cause.
+			defer allocator.free(full_name);
 			const descendants = try reader.readU16();
 			const subtree_count: usize = @as(usize, descendants) + 1;
 			if (subtree_count > remaining) return Error.InvalidEntryCount;
-			defer allocator.free(full_name);
 			try parseDirectoryEntries(allocator, reader, acc, full_name, @intCast(descendants));
 			remaining -= subtree_count;
 			continue;
 		}
 
+		// File entries: full_name transfers to acc on successful append. errdefer
+		// handles the error path; successful iteration leaves full_name owned by acc.
+		errdefer allocator.free(full_name);
+
 		const entry = MetadataEntry{
 			.name = full_name,
 			.volume = try reader.readU8(),

tests/unit/zig_unit_tests.zig

@@ -381,3 +381,32 @@ test "archive header crc changes when entry metadata changes" {
 	const crc_b = readU32BE(archive_b, @intCast(off_b));
 	try std.testing.expect(crc_a != crc_b);
 }
+
+test "parseMetadata: corrupted directory entry must not double-free (regression)" {
+	// Reproduces a real crash found by validate --test-coverage stress testing: a
+	// truncated CPT archive whose outer entry is a directory used to free the
+	// directory's full_name path twice (outer errdefer + inner defer on the same
+	// allocation) when the recursive parse hit Truncated. std.testing.allocator's
+	// GeneralPurposeAllocator surfaces the double-free as a test failure. Uses a
+	// non-empty directory name so the allocation is actually tracked.
+	var buf: std.ArrayListUnmanaged(u8) = .{};
+	defer buf.deinit(allocator());
+
+	// Preamble: marker(0x01) + pad(1) + pad(2) + header_offset=u32 BE -> 8
+	try buf.append(allocator(), 0x01);
+	try buf.append(allocator(), 0);
+	try buf.appendSlice(allocator(), &[_]u8{ 0, 0 });
+	try buf.appendSlice(allocator(), &[_]u8{ 0, 0, 0, 8 });
+
+	// Header: crc(u32 BE, ignored when strict=false), entry_count=2 (u16 BE),
+	// comment_len=0, then one dir entry (name_len_kind=0x83 → is_dir + name_len=3),
+	// name="dir", descendants=1, then truncated so the recursive call errors out.
+	try buf.appendSlice(allocator(), &[_]u8{ 0, 0, 0, 0 });
+	try buf.appendSlice(allocator(), &[_]u8{ 0, 2 });
+	try buf.append(allocator(), 0);
+	try buf.append(allocator(), 0x83);
+	try buf.appendSlice(allocator(), "dir");
+	try buf.appendSlice(allocator(), &[_]u8{ 0, 1 });
+
+	try std.testing.expectError(core.Error.Truncated, core.parseMetadata(allocator(), buf.items, false));
+}