From owner-freebsd-bugs  Fri Jun 13 19:01:14 1997
Return-Path: <owner-bugs>
Received: (from root@localhost)
          by hub.freebsd.org (8.8.5/8.8.5) id TAA03471
          for bugs-outgoing; Fri, 13 Jun 1997 19:01:14 -0700 (PDT)
Received: from godzilla.zeta.org.au (godzilla.zeta.org.au [203.2.228.19])
          by hub.freebsd.org (8.8.5/8.8.5) with ESMTP id TAA03466
          for <freebsd-bugs@hub.freebsd.org>; Fri, 13 Jun 1997 19:01:09 -0700 (PDT)
Received: (from bde@localhost) by godzilla.zeta.org.au (8.8.5/8.6.9) id LAA12946; Sat, 14 Jun 1997 11:56:35 +1000
Date: Sat, 14 Jun 1997 11:56:35 +1000
From: Bruce Evans <bde@zeta.org.au>
Message-Id: <199706140156.LAA12946@godzilla.zeta.org.au>
To: ac199@hwcn.org, freebsd-bugs@hub.freebsd.org
Subject: Re: bin/3451: vasprintf() doesn't work.
Sender: owner-bugs@FreeBSD.ORG
X-Loop: FreeBSD.org
Precedence: bulk

> realloc() can fail, resulting in a null pointer dereference.  That's
> undesirable.
> 
> Try, instead,
>...
>   	*str = realloc(h.base, (size_t)(h.size - h.left + 1));
>   	if (*str == NULL)	/* failed to realloc it to actual size */
> ! 		return (-1);
> ! 	(*str)[h.size - h.left] = '\0';
>   	return (ret);
>   }

One more problem: realloc() can fail, resulting in a leaking the memory
pointed to by h.base.

Bruce