Date: Fri, 23 Mar 2001 21:00:18 -0800 (PST) From: miles@turboflux.net To: freebsd-gnats-submit@FreeBSD.org Subject: misc/26044: vsprintf calls __swsetup, then __smakebuf, it allocates mem and never frees it Message-ID: <200103240500.f2O50Ir84611@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 26044 >Category: misc >Synopsis: vsprintf calls __swsetup, then __smakebuf, it allocates mem and never frees it >Confidential: no >Severity: serious >Priority: medium >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Fri Mar 23 21:10:01 PST 2001 >Closed-Date: >Last-Modified: >Originator: Miles Peterson >Release: 4.2-STABLE >Organization: >Environment: FreeBSD Phased.turboflux.net 4.2-STABLE FreeBSD 4.2-STABLE #2: Wed Dec 27 11:49:05 MST 2000 root@Phased.turboflux.net:/usr/src/sys/compile/BRIDGE i386 >Description: vsnprintf() has "FILE f" and sets "f._bf._base = str;" (where str is what the user passes in). If user passes in NULL, __swsetup(&f) calls __smakebuf(&f), which allocates a buffer that isnt ever freed. /usr/src/lib/libc/stdio/vsnprintf.c >How-To-Repeat: vsnprintf(NULL, 0, "yadda yadda!\n"); /* should do it */ >Fix: if (!str) free(p._bf._base); /* just before the return (ret) */ >Release-Note: >Audit-Trail: >Unformatted: To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-bugs" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200103240500.f2O50Ir84611>