Initialize retctx,ctx before freeing the inner elements

In rz_core_analysis_type_match retctx structure was initialized on the
stack only after a "goto out_function", where a field of that structure
was freed. When the goto path is taken, the field is not properly
initialized and it cause cause a crash of Rizin or have other effects.

Fixes: CVE-2021-4022

Author: ret2libc

librz/analysis/var.c

@@ -1103,13 +1103,15 @@ RZ_API void rz_analysis_extract_rarg(RzAnalysis *analysis, RzAnalysisOp *op, RzA
 RZ_API void rz_analysis_extract_vars(RzAnalysis *analysis, RzAnalysisFunction *fcn, RzAnalysisOp *op) {
 	rz_return_if_fail(analysis && fcn && op);
 
-	const char *BP = analysis->reg->name[RZ_REG_NAME_BP];
-	const char *SP = analysis->reg->name[RZ_REG_NAME_SP];
+	const char *BP = rz_reg_get_name(analysis->reg, RZ_REG_NAME_BP);
+	const char *SP = rz_reg_get_name(analysis->reg, RZ_REG_NAME_SP);
 	if (BP) {
 		extract_arg(analysis, fcn, op, BP, "+", RZ_ANALYSIS_VAR_KIND_BPV);
 		extract_arg(analysis, fcn, op, BP, "-", RZ_ANALYSIS_VAR_KIND_BPV);
 	}
-	extract_arg(analysis, fcn, op, SP, "+", RZ_ANALYSIS_VAR_KIND_SPV);
+	if (SP) {
+		extract_arg(analysis, fcn, op, SP, "+", RZ_ANALYSIS_VAR_KIND_SPV);
+	}
 }
 
 static RzList *var_generate_list(RzAnalysis *a, RzAnalysisFunction *fcn, int kind) {

librz/core/analysis_tp.c

@@ -843,6 +843,19 @@ RZ_API void rz_core_analysis_type_match(RzCore *core, RzAnalysisFunction *fcn, H
 	dtrace->ht = ht_pp_new_size(fcn->ninstr, opt.dupvalue, opt.freefn, opt.calcsizeV);
 	dtrace->ht->opt = opt;
 
+	// Create a new context to store the return type propagation state
+	struct ReturnTypeAnalysisCtx retctx = {
+		.resolved = false,
+		.ret_type = NULL,
+		.ret_reg = NULL,
+	};
+	struct TypeAnalysisCtx ctx = {
+		.retctx = &retctx,
+		.cur_idx = 0,
+		.prev_dest = NULL,
+		.str_flag = false
+	};
+
 	HtUP *op_cache = NULL;
 	const char *pc = rz_reg_get_name(core->dbg->reg, RZ_REG_NAME_PC);
 	if (!pc) {
@@ -856,18 +869,6 @@ RZ_API void rz_core_analysis_type_match(RzCore *core, RzAnalysisFunction *fcn, H
 	rz_list_sort(fcn->bbs, bb_cmpaddr);
 	// TODO: The algorithm can be more accurate if blocks are followed by their jmp/fail, not just by address
 	RzAnalysisBlock *bb;
-	// Create a new context to store the return type propagation state
-	struct ReturnTypeAnalysisCtx retctx = {
-		.resolved = false,
-		.ret_type = NULL,
-		.ret_reg = NULL
-	};
-	struct TypeAnalysisCtx ctx = {
-		.retctx = &retctx,
-		.cur_idx = 0,
-		.prev_dest = NULL,
-		.str_flag = false
-	};
 	rz_list_foreach (fcn->bbs, it, bb) {
 		ut64 addr = bb->addr;
 		rz_reg_set_value(core->dbg->reg, r, addr);

librz/core/canalysis.c

@@ -5371,6 +5371,9 @@ RZ_API void rz_core_analysis_esil(RzCore *core, const char *str, const char *tar
 		rz_core_analysis_esil_init_mem(core, NULL, UT64_MAX, UT32_MAX);
 	}
 	const char *spname = rz_reg_get_name(core->analysis->reg, RZ_REG_NAME_SP);
+	if (!spname) {
+		goto out_pop_regs;
+	}
 	EsilBreakCtx ctx = {
 		&op,
 		fcn,