Use after free when fseeko fails
In _zip_stdio_op_create_temp_output_cloning when fseeko fails the temp
value gets freed but then the freed pointer is assigned to ctx->tmpname.
diff --git a/lib/zip_source_file_stdio_named.c b/lib/zip_source_file_stdio_named.c
index 5387c76..8027e73 100644
--- a/lib/zip_source_file_stdio_named.c
+++ b/lib/zip_source_file_stdio_named.c
@@ -255,6 +255,7 @@
(void)remove(temp);
free(temp);
zip_error_set(&ctx->error, ZIP_ER_TMPOPEN, errno);
+ return -1;
}
ctx->fout = tfp;
