diff options
| author | Joseph Myers <joseph@codesourcery.com> | 2020-07-09 21:52:24 +0000 |
|---|---|---|
| committer | Joseph Myers <joseph@codesourcery.com> | 2020-07-09 21:52:24 +0000 |
| commit | 90663e9c814a919fa1fb41a878c06ef2fae58ed2 (patch) | |
| tree | 1ad0ca625f237ddb83265ea21988dcec972abeb5 /stdio-common/printf_fp.c | |
| parent | ede56038e50235cd1ca7de3602c9491d3b84b49b (diff) | |
| download | glibc-90663e9c814a919fa1fb41a878c06ef2fae58ed2.tar.gz glibc-90663e9c814a919fa1fb41a878c06ef2fae58ed2.tar.xz glibc-90663e9c814a919fa1fb41a878c06ef2fae58ed2.zip | |
Fix memory leak in __printf_fp_l (bug 26215).
__printf_fp_l has a memory leak in the case of some I/O errors, where both buffer and wbuffer have been malloced but the handling of I/O errors only frees wbuffer. This patch fixes this by moving the declaration of buffer to an outer scope and ensuring that it is freed when wbuffer is freed. Tested for x86_64 and x86.
Diffstat (limited to 'stdio-common/printf_fp.c')
| -rw-r--r-- | stdio-common/printf_fp.c | 20 |
1 files changed, 15 insertions, 5 deletions
diff --git a/stdio-common/printf_fp.c b/stdio-common/printf_fp.c index 49c693575e..c0b79f2184 100644 --- a/stdio-common/printf_fp.c +++ b/stdio-common/printf_fp.c @@ -72,7 +72,10 @@ if (putc (outc, fp) == EOF) \ { \ if (buffer_malloced) \ - free (wbuffer); \ + { \ + free (buffer); \ + free (wbuffer); \ + } \ return -1; \ } \ ++done; \ @@ -87,7 +90,10 @@ if (PUT (fp, wide ? (const char *) wptr : ptr, outlen) != outlen) \ { \ if (buffer_malloced) \ - free (wbuffer); \ + { \ + free (buffer); \ + free (wbuffer); \ + } \ return -1; \ } \ ptr += outlen; \ @@ -110,7 +116,10 @@ if (PAD (fp, ch, len) != len) \ { \ if (buffer_malloced) \ - free (wbuffer); \ + { \ + free (buffer); \ + free (wbuffer); \ + } \ return -1; \ } \ done += len; \ @@ -259,7 +268,8 @@ __printf_fp_l (FILE *fp, locale_t loc, /* Buffer in which we produce the output. */ wchar_t *wbuffer = NULL; - /* Flag whether wbuffer is malloc'ed or not. */ + char *buffer = NULL; + /* Flag whether wbuffer and buffer are malloc'ed or not. */ int buffer_malloced = 0; p.expsign = 0; @@ -1172,7 +1182,6 @@ __printf_fp_l (FILE *fp, locale_t loc, PADN ('0', width); { - char *buffer = NULL; char *buffer_end = NULL; char *cp = NULL; char *tmpptr; @@ -1252,6 +1261,7 @@ __printf_fp_l (FILE *fp, locale_t loc, free (wbuffer); /* Avoid a double free if the subsequent PADN encounters an I/O error. */ + buffer = NULL; wbuffer = NULL; } } |