[BZ #2072]

	* stdio-common/printf_fp.c: Fix potential memory leaks for
	malloc'ed wbuffer isn't freed in error conditions.

diff --git a/ChangeLog b/ChangeLog
index 9e143582a81ade7c9f938455dfb15b34166d8212..28bb8934fd320649bc46572e961f0dbb2b4e559a 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,9 @@
 2006-04-25  Ulrich Drepper  <drepper@redhat.com>
 
+       [BZ #2072]
+       * stdio-common/printf_fp.c: Fix potential memory leaks for
+       malloc'ed wbuffer isn't freed in error conditions.
+
        [BZ #2569]
        * iconv/gconv_db.c (__gconv_release_step): Fix condition of assert
        call.

diff --git a/stdio-common/printf_fp.c b/stdio-common/printf_fp.c
index 8a68f1948d414bee11b5bbe6b66da4b60bfa904b..e4e32f9c2815d6180a2849b6407f3158064e83a2 100644 (file)
--- a/stdio-common/printf_fp.c
+++ b/stdio-common/printf_fp.c
@@ -72,7 +72,11 @@
     {                                                                        \
       register const int outc = (ch);                                        \
       if (putc (outc, fp) == EOF)                                            \
-       return -1;                                                            \
+       {                                                                     \
+         if (buffer_malloced)                                                \
+           free (wbuffer);                                                   \
+         return -1;                                                          \
+       }                                                                     \
       ++done;                                                                \
     } while (0)
 
@@ -83,7 +87,11 @@
       if (len > 20)                                                          \
        {                                                                     \
          if (PUT (fp, wide ? (const char *) wptr : ptr, outlen) != outlen)   \
-           return -1;                                                        \
+           {                                                                 \
+             if (buffer_malloced)                                            \
+               free (wbuffer);                                               \
+             return -1;                                                      \
+           }                                                                 \
          ptr += outlen;                                                      \
          done += outlen;                                                     \
        }                                                                     \
@@ -102,7 +110,11 @@
   do                                                                         \
     {                                                                        \
       if (PAD (fp, ch, len) != len)                                          \
-       return -1;                                                            \
+       {                                                                     \
+         if (buffer_malloced)                                                \
+           free (wbuffer);                                                   \
+         return -1;                                                          \
+       }                                                                     \
       done += len;                                                           \
     }                                                                        \
   while (0)
@@ -200,6 +212,11 @@ ___printf_fp (FILE *fp,
   /* Nonzero if this is output on a wide character stream.  */
   int wide = info->wide;
 
+  /* Buffer in which we produce the output.  */
+  wchar_t *wbuffer = NULL;
+  /* Flag whether wbuffer is malloc'ed or not.  */
+  int buffer_malloced = 0;
+
   auto wchar_t hack_digit (void);
 
   wchar_t hack_digit (void)
@@ -790,8 +807,7 @@ ___printf_fp (FILE *fp,
 
   {
     int width = info->width;
-    wchar_t *wbuffer, *wstartp, *wcp;
-    int buffer_malloced;
+    wchar_t *wstartp, *wcp;
     int chars_needed;
     int expscale;
     int intdig_max, intdig_no = 0;
@@ -1109,8 +1125,12 @@ ___printf_fp (FILE *fp,
              buffer = (char *) malloc (2 + chars_needed + decimal_len
                                        + ngroups * thousands_sep_len);
              if (buffer == NULL)
-               /* Signal an error to the caller.  */
-               return -1;
+               {
+                 /* Signal an error to the caller.  */
+                 if (buffer_malloced)
+                   free (wbuffer);
+                 return -1;
+               }
            }
          else
            buffer = (char *) alloca (2 + chars_needed + decimal_len