* stdio-common/vfprintf.c (vfprintf): Check malloc return; don't

	call free(NULL).

diff --git a/ChangeLog b/ChangeLog
index dff539892b9f7b36bfd6870b3182af85bb243233..b1e02a7123a1eeb29c6e363dfe73fab6f24e82c7 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,8 +1,13 @@
+2013-03-05  Paul Pluzhnikov  <ppluzhnikov@google.com>
+
+       * stdio-common/vfprintf.c (vfprintf): Check malloc return; don't
+       call free(NULL).
+
 2013-03-05  David S. Miller  <davem@davemloft.net>
 
        * po/es.po: Update from translation team.
 
-2013-03-04  Andreas Jaeger  <aj@suse.de>
+2013-03-05  Andreas Jaeger  <aj@suse.de>
 
        * sysdeps/unix/sysv/linux/s390/bits/mman.h: Include
        <bits/mman-linux.h>.

diff --git a/stdio-common/vfprintf.c b/stdio-common/vfprintf.c
index 89126d2d0a16cdeb1918a50790089c0c83a9f369..70420902687491cc44807983b4755b39737bf45b 100644 (file)
--- a/stdio-common/vfprintf.c
+++ b/stdio-common/vfprintf.c
@@ -1691,7 +1691,8 @@ do_positional:
     /* Just a counter.  */
     size_t cnt;
 
-    free (workstart);
+    if (__builtin_expect (workstart != NULL, 0))
+      free (workstart);
     workstart = NULL;
 
     if (grouping == (const char *) -1)
@@ -1944,6 +1945,11 @@ do_positional:
              {
                workstart = (CHAR_T *) malloc ((MAX (prec, width) + 32)
                                               * sizeof (CHAR_T));
+               if (workstart == NULL)
+                 {
+                   done = -1;
+                   goto all_done;
+                 }
                workend = workstart + (MAX (prec, width) + 32);
              }
          }
@@ -2021,7 +2027,8 @@ do_positional:
            break;
          }
 
-       free (workstart);
+       if (__builtin_expect (workstart != NULL, 0))
+         free (workstart);
        workstart = NULL;
 
        /* Write the following constant string.  */
@@ -2032,8 +2039,10 @@ do_positional:
   }
 
 all_done:
-  free (args_malloced);
-  free (workstart);
+  if (__builtin_expect (args_malloced != NULL, 0))
+    free (args_malloced);
+  if (__builtin_expect (workstart != NULL, 0))
+    free (workstart);
   /* Unlock the stream.  */
   _IO_funlockfile (s);
   _IO_cleanup_region_end (0);