In the event the heap allocation fails after a successful allocation,

restore fmtbuff back to fmtbuff_stack, per the intent of the else
condition

Otherwise, there's a chance that fmtbuff used after the mbtowc call
is using an invalid buffer, as fmtbuff_heap has been already free'd.

Reported by:	Coverity
CID:		1006126

diff --git a/tar/util.c b/tar/util.c
index 2b4aebe8e6079caad7609ca830530674c8f960db..8f65b1762740e4eb23a6470714e8ca1fc2830c84 100644 (file)
--- a/tar/util.c
+++ b/tar/util.c
@@ -140,6 +140,7 @@ safe_fprintf(FILE *f, const char *fmt, ...)
                } else {
                        /* Leave fmtbuff pointing to the truncated
                         * string in fmtbuff_stack. */
+                       fmtbuff = fmtbuff_stack;
                        length = sizeof(fmtbuff_stack) - 1;
                        break;
                }