Fix memory leaks in libio on allocation failure

diff --git a/ChangeLog b/ChangeLog
index 306dda7706820653dcf9d9877e4a6338f7d035c7..30c6a3996193a3c05cca4f1da35fc0ee5c6a6ce7 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,9 @@
 2013-09-09  Allan McRae  <allan@archlinux.org>
 
+       [BZ #15892]
+       * libio/memstream.c (open_memstream): Fix memory leak.
+       * libio/wmemstream.c (open_wmemstream): Likewise.
+
        [BZ #15895]
        * nscd/netgroupcache.c: Fix nesting of ifdefs.
 

diff --git a/NEWS b/NEWS
index 5ade03cbe294eeee4a3dfa90818597ab9a3ecd18..72c10e646b2e08187addec2371927855ff609a91 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -10,7 +10,7 @@ Version 2.19
 * The following bugs are resolved with this release:
 
   14155, 14699, 15427, 15522, 15531, 15532, 15736, 15749, 15797, 15844,
-  15867, 15886, 15887, 15890, 15895, 15897, 15905, 15909, 15921.
+  15867, 15886, 15887, 15890, 15892, 15895, 15897, 15905, 15909, 15921.
 
 * CVE-2013-4237 The readdir_r function could write more than NAME_MAX bytes
   to the d_name member of struct dirent, or omit the terminating NUL

diff --git a/libio/memstream.c b/libio/memstream.c
index 34534e2f94c4a29d66f0e6d76fd6cb8798d9e136..3cb1bd7057de44f11b975c04973c9a4735a5e5ba 100644 (file)
--- a/libio/memstream.c
+++ b/libio/memstream.c
@@ -84,7 +84,10 @@ open_memstream (bufloc, sizeloc)
 
   buf = calloc (1, _IO_BUFSIZ);
   if (buf == NULL)
-    return NULL;
+    {
+      free (new_f);
+      return NULL;
+    }
   _IO_init (&new_f->fp._sf._sbf._f, 0);
   _IO_JUMPS ((struct _IO_FILE_plus *) &new_f->fp._sf._sbf) = &_IO_mem_jumps;
   _IO_str_init_static_internal (&new_f->fp._sf, buf, _IO_BUFSIZ, buf);

diff --git a/libio/wmemstream.c b/libio/wmemstream.c
index 65738d4d7f241c456309b69d0309b41896ca7def..fd7fe44c4c34d76af8a5375a2b6644a5238f0cae 100644 (file)
--- a/libio/wmemstream.c
+++ b/libio/wmemstream.c
@@ -85,8 +85,10 @@ open_wmemstream (bufloc, sizeloc)
 
   buf = calloc (1, _IO_BUFSIZ);
   if (buf == NULL)
-    return NULL;
-
+    {
+      free (new_f);
+      return NULL;
+    }
   _IO_no_init (&new_f->fp._sf._sbf._f, 0, 0, &new_f->wd, &_IO_wmem_jumps);
   _IO_fwide (&new_f->fp._sf._sbf._f, 1);
   _IO_wstr_init_static (&new_f->fp._sf._sbf._f, buf,