When malloc() fails in indent_msg, the function returned NULL without
freeing the original *out string as it was supposed to. The caller loses
both the original string (leaked) and gets NULL back. Fixed to free *out
and set it to NULL before returning.
needed = 1 + level * (lf + 1) + len + 1;
p = ret = malloc(needed);
if (unlikely(!ret))
- return NULL;
+ goto leave;
+
in = *out;
/* skip initial LFs */
}
*p = 0;
+ leave:
free(*out);
*out = ret;