lib/glibc
1
0
Fork 0
mirror of https://sourceware.org/git/glibc.git synced 2025-08-08 17:42:12 +03:00
Code Activity

Fix memory leak in __printf_fp_l (bug 26215).

Browse Source 
__printf_fp_l has a memory leak in the case of some I/O errors, where
both buffer and wbuffer have been malloced but the handling of I/O
errors only frees wbuffer.  This patch fixes this by moving the
declaration of buffer to an outer scope and ensuring that it is freed
when wbuffer is freed.

Tested for x86_64 and x86.
This commit is contained in:
Joseph Myers
2020-07-09 21:52:24 +00:00
parent ede56038e5
commit 90663e9c81
3 changed files with 57 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
stdio-common/printf_fp.c
View File

@@ -72,7 +72,10 @@
if (putc (outc, fp) == EOF) \
{ \
if (buffer_malloced) \
free (wbuffer); \
{ \
free (buffer); \
free (wbuffer); \
} \
return -1; \
} \
++done; \
@@ -87,7 +90,10 @@
if (PUT (fp, wide ? (const char *) wptr : ptr, outlen) != outlen) \
{ \
if (buffer_malloced) \
free (wbuffer); \
{ \
free (buffer); \
free (wbuffer); \
} \
return -1; \
} \
ptr += outlen; \
@@ -110,7 +116,10 @@
if (PAD (fp, ch, len) != len) \
{ \
if (buffer_malloced) \
free (wbuffer); \
{ \
free (buffer); \
free (wbuffer); \
} \
return -1; \
} \
done += len; \
@@ -259,7 +268,8 @@ __printf_fp_l (FILE *fp, locale_t loc,
/* Buffer in which we produce the output. */
wchar_t *wbuffer = NULL;
/* Flag whether wbuffer is malloc'ed or not. */
char *buffer = NULL;
/* Flag whether wbuffer and buffer are malloc'ed or not. */
int buffer_malloced = 0;
p.expsign = 0;
@@ -1172,7 +1182,6 @@ __printf_fp_l (FILE *fp, locale_t loc,
PADN ('0', width);
{
char *buffer = NULL;
char *buffer_end = NULL;
char *cp = NULL;
char *tmpptr;
@@ -1252,6 +1261,7 @@ __printf_fp_l (FILE *fp, locale_t loc,
free (wbuffer);
/* Avoid a double free if the subsequent PADN encounters an
I/O error. */
buffer = NULL;
wbuffer = NULL;
}
}