* Dmitry Bogatov <kact...@gnu.org> [2014-04-10 20:52:43+0400]
> > > +       {
> > > +         free (nargv);
> > >           return 0L;
> > > +       }
> > >       else
> > >         nargv[nargi++] = narg;
> > I don't understand this.  In both cases, free() will be called with an
> > argument of 0, which does nothing.
> My bad. It does not fix problem, that if realloc fails, it does not free
> memory, but we blindly assign, losing pointer to previous memory
> chunk.

Attached new version. Please, take a look.

--
Best regards, Dmitry Bogatov <kact...@gnu.org>,
Free Software supporter, esperantisto and netiquette guardian.
        git://kaction.name/rc-files.git
        GPG: 54B7F00D
>From d3ce0b807aa624a9316e2b7da024f030233dae74 Mon Sep 17 00:00:00 2001
From: Dmitry Bogatov <kact...@gnu.org>
Date: Thu, 10 Apr 2014 09:23:28 +0400
Subject: [PATCH] Fix memory leak on `realloc' failure

Signed-off-by: Dmitry Bogatov <kact...@gnu.org>
---
 libguile/script.c | 21 ++++++++++++++++++---
 1 file changed, 18 insertions(+), 3 deletions(-)

diff --git a/libguile/script.c b/libguile/script.c
index 6a8cc43..07a8040 100644
--- a/libguile/script.c
+++ b/libguile/script.c
@@ -220,6 +220,21 @@ script_get_backslash (FILE *f)
 }
 #undef FUNC_NAME
 
+/*
+ * Like `realloc', but free memory on failure;
+ * unlike `scm_realloc', return NULL, not aborts.
+*/
+static void*
+realloc0 (void *ptr, size_t size)
+{
+  void *new_ptr = realloc (ptr, size);
+  if (!new_ptr)
+    {
+      free (ptr);
+    }
+  return new_ptr;
+}
+
 
 static char *
 script_read_arg (FILE *f)
@@ -245,7 +260,7 @@ script_read_arg (FILE *f)
 	  if (len >= size)
 	    {
 	      size = (size + 1) * 2;
-	      buf = realloc (buf, size);
+	      buf = realloc0 (buf, size);
 	      if (! buf)
 		return 0;
 	    }
@@ -328,9 +343,9 @@ scm_get_meta_args (int argc, char **argv)
 	found_args:
           /* FIXME: we leak the result of calling script_read_arg.  */
 	  while ((narg = script_read_arg (f)))
-	    if (!(nargv = (char **) realloc (nargv,
+	    if (!(nargv = (char **) realloc0 (nargv,
 					     (1 + ++nargc) * sizeof (char *))))
-	        return 0L;
+	      return 0L;
 	    else
 	      nargv[nargi++] = narg;
 	  fclose (f);
-- 
I may be not subscribed. Please, keep me in carbon copy.

Reply via email to