From 3fab177f90d39618c9a15ebf1db796d3f9eef725 Mon Sep 17 00:00:00 2001
From: "Stephen J. Kiernan" <stevek@FreeBSD.org>
Date: Thu, 1 Jun 2017 19:21:30 +0000
Subject: [PATCH] Fix memory leak in edithost

The problem is that when the parameter 'pat' is null, the function locally
allocates a NULL string but never frees it.

Instead of tracking the local alloc, it is noted that the while(*pat) never
enters when there is a local alloc.
So instead of doing the local alloc, check that 'pat' is null before the
while(*pat) loop.

Found using clang's static analyzer - scan-build

Submitted by:	Thomas Rix <trix@juniper.net>
Reviewed by:	markm
Approved by:	sjg (mentor)
MFC after:	1 week
Differential Revision:	https://reviews.freebsd.org/D9689
---
 contrib/telnet/telnetd/utility.c | 40 ++++++++++++++++----------------
 1 file changed, 20 insertions(+), 20 deletions(-)

diff --git a/contrib/telnet/telnetd/utility.c b/contrib/telnet/telnetd/utility.c
index 905fd3b2d65d..1d3731e1c706 100644
--- a/contrib/telnet/telnetd/utility.c
+++ b/contrib/telnet/telnetd/utility.c
@@ -360,30 +360,30 @@ edithost(char *pat, char *host)
 {
 	char *res = editedhost;
 
-	if (!pat)
-		pat = strdup("");
-	while (*pat) {
-		switch (*pat) {
+	if (pat) {
+		while (*pat) {
+			switch (*pat) {
 
-		case '#':
-			if (*host)
-				host++;
-			break;
+			case '#':
+				if (*host)
+					host++;
+				break;
 
-		case '@':
-			if (*host)
-				*res++ = *host++;
-			break;
+			case '@':
+				if (*host)
+					*res++ = *host++;
+				break;
 
-		default:
-			*res++ = *pat;
-			break;
+			default:
+				*res++ = *pat;
+				break;
+			}
+			if (res == &editedhost[sizeof editedhost - 1]) {
+				*res = '\0';
+				return;
+			}
+			pat++;
 		}
-		if (res == &editedhost[sizeof editedhost - 1]) {
-			*res = '\0';
-			return;
-		}
-		pat++;
 	}
 	if (*host)
 		(void) strncpy(res, host,