about summary refs log tree commit diff
path: root/stdio-common/vfprintf.c
diff options
context:
space:
mode:
authorPaul Pluzhnikov <ppluzhnikov@google.com>2013-03-05 13:44:33 -0800
committerPaul Pluzhnikov <ppluzhnikov@google.com>2013-03-05 13:44:33 -0800
commitcdcf361fda31ec8b3e93e89d5aa26ee5b68f8867 (patch)
tree194bbdc639036865a86266dad0f93320167ec81a /stdio-common/vfprintf.c
parent72a3b700c592d39e0e76cd75b2c5ff483e70e083 (diff)
downloadglibc-cdcf361fda31ec8b3e93e89d5aa26ee5b68f8867.tar.gz
glibc-cdcf361fda31ec8b3e93e89d5aa26ee5b68f8867.tar.xz
glibc-cdcf361fda31ec8b3e93e89d5aa26ee5b68f8867.zip
* stdio-common/vfprintf.c (vfprintf): Check malloc return; don't
	call free(NULL).
Diffstat (limited to 'stdio-common/vfprintf.c')
-rw-r--r--stdio-common/vfprintf.c17
1 files changed, 13 insertions, 4 deletions
diff --git a/stdio-common/vfprintf.c b/stdio-common/vfprintf.c
index 89126d2d0a..7042090268 100644
--- a/stdio-common/vfprintf.c
+++ b/stdio-common/vfprintf.c
@@ -1691,7 +1691,8 @@ do_positional:
     /* Just a counter.  */
     size_t cnt;
 
-    free (workstart);
+    if (__builtin_expect (workstart != NULL, 0))
+      free (workstart);
     workstart = NULL;
 
     if (grouping == (const char *) -1)
@@ -1944,6 +1945,11 @@ do_positional:
 	      {
 		workstart = (CHAR_T *) malloc ((MAX (prec, width) + 32)
 					       * sizeof (CHAR_T));
+		if (workstart == NULL)
+		  {
+		    done = -1;
+		    goto all_done;
+		  }
 		workend = workstart + (MAX (prec, width) + 32);
 	      }
 	  }
@@ -2021,7 +2027,8 @@ do_positional:
 	    break;
 	  }
 
-	free (workstart);
+	if (__builtin_expect (workstart != NULL, 0))
+	  free (workstart);
 	workstart = NULL;
 
 	/* Write the following constant string.  */
@@ -2032,8 +2039,10 @@ do_positional:
   }
 
 all_done:
-  free (args_malloced);
-  free (workstart);
+  if (__builtin_expect (args_malloced != NULL, 0))
+    free (args_malloced);
+  if (__builtin_expect (workstart != NULL, 0))
+    free (workstart);
   /* Unlock the stream.  */
   _IO_funlockfile (s);
   _IO_cleanup_region_end (0);