]> Savannah Git Hosting - gnulib.git/commitdiff
canonicalize-lgpl: fix memory leak
authorPaul Eggert <eggert@cs.ucla.edu>
Mon, 23 Nov 2020 07:37:57 +0000 (23:37 -0800)
committerPaul Eggert <eggert@cs.ucla.edu>
Mon, 23 Nov 2020 07:39:13 +0000 (23:39 -0800)
* lib/canonicalize-lgpl.c (__realpath): Fix unlikely memory leak,
which could have occurred if BUF was so large that malloc was
called.  Do this by allocating EXTRA_BUF and BUF at the same time;
this eliminates the need to free BUF separately.

ChangeLog
lib/canonicalize-lgpl.c

index 42195d232664f4e8d120258e4967ddec3e517f6a..044b12d8c0ee44b946cb4772cf4b22a63cf36b46 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,11 @@
+2020-11-22  Paul Eggert  <eggert@cs.ucla.edu>
+
+       canonicalize-lgpl: fix memory leak
+       * lib/canonicalize-lgpl.c (__realpath): Fix unlikely memory leak,
+       which could have occurred if BUF was so large that malloc was
+       called.  Do this by allocating EXTRA_BUF and BUF at the same time;
+       this eliminates the need to free BUF separately.
+
 2020-11-22  Bruno Haible  <bruno@clisp.org>
 
        Fix missing module dependencies to 'xalloc' (regression 2020-10-19).
index cc42662dbfe5b159be9325806b74291ffba0f0cd..edac98f838a44ad68340270dc949e776bd09033f 100644 (file)
@@ -293,39 +293,26 @@ __realpath (const char *name, char *resolved)
                   goto error;
                 }
 
-              buf = malloca (path_max);
-              if (!buf)
-                {
-                  __set_errno (ENOMEM);
-                  goto error;
-                }
-
-              n = __readlink (rpath, buf, path_max - 1);
-              if (n < 0)
-                {
-                  int saved_errno = errno;
-                  freea (buf);
-                  __set_errno (saved_errno);
-                  goto error;
-                }
-              buf[n] = '\0';
-
               if (!extra_buf)
                 {
-                  extra_buf = malloca (path_max);
+                  extra_buf = malloca (2 * path_max);
                   if (!extra_buf)
                     {
-                      freea (buf);
-                      __set_errno (ENOMEM);
+                      alloc_failed ();
                       goto error;
                     }
                 }
+              buf = extra_buf + path_max;
+
+              n = __readlink (rpath, buf, path_max - 1);
+              if (n < 0)
+                goto error;
+              buf[n] = '\0';
 
               len = strlen (end);
               /* Check that n + len + 1 doesn't overflow and is <= path_max. */
               if (n >= SIZE_MAX - len || n + len >= path_max)
                 {
-                  freea (buf);
                   __set_errno (ENAMETOOLONG);
                   goto error;
                 }