From 5694a8569bd5c057cbf3a314c8bc3fab41f9b91a Mon Sep 17 00:00:00 2001
From: jilles <jilles@FreeBSD.org>
Date: Wed, 30 Dec 2009 17:16:49 +0000
Subject: [PATCH] Fix memory leak when parsing backticks (``).

---
 bin/sh/parser.c | 36 +++++++++++++++++++++++-------------
 1 file changed, 23 insertions(+), 13 deletions(-)

diff --git a/bin/sh/parser.c b/bin/sh/parser.c
index b1547e3e06f9..b85d10ad2e6f 100644
--- a/bin/sh/parser.c
+++ b/bin/sh/parser.c
@@ -1311,11 +1311,16 @@ parsebackq: {
 	int savelen;
 	int saveprompt;
 	const int bq_startlinno = plinno;
+	char *volatile ostr = NULL;
+	struct parsefile *const savetopfile = getcurrentfile();
 
 	str = NULL;
 	if (setjmp(jmploc.loc)) {
+		popfilesupto(savetopfile);
 		if (str)
 			ckfree(str);
+		if (ostr)
+			ckfree(ostr);
 		handler = savehandler;
 		if (exception == EXERROR) {
 			startlinno = bq_startlinno;
@@ -1335,13 +1340,12 @@ parsebackq: {
                 /* We must read until the closing backquote, giving special
                    treatment to some slashes, and then push the string and
                    reread it as input, interpreting it normally.  */
-                char *out;
+                char *oout;
                 int c;
-                int savelen;
-                char *str;
+                int olen;
 
 
-                STARTSTACKSTR(out);
+                STARTSTACKSTR(oout);
 		for (;;) {
 			if (needprompt) {
 				setprompt(2);
@@ -1368,7 +1372,7 @@ parsebackq: {
 				}
                                 if (c != '\\' && c != '`' && c != '$'
                                     && (!dblquote || c != '"'))
-                                        STPUTC('\\', out);
+                                        STPUTC('\\', oout);
 				break;
 
 			case '\n':
@@ -1384,16 +1388,16 @@ parsebackq: {
 			default:
 				break;
 			}
-			STPUTC(c, out);
+			STPUTC(c, oout);
                 }
 done:
-                STPUTC('\0', out);
-                savelen = out - stackblock();
-                if (savelen > 0) {
-                        str = ckmalloc(savelen);
-                        memcpy(str, stackblock(), savelen);
-			setinputstring(str, 1);
-                }
+                STPUTC('\0', oout);
+                olen = oout - stackblock();
+		INTOFF;
+		ostr = ckmalloc(olen);
+		memcpy(ostr, stackblock(), olen);
+		setinputstring(ostr, 1);
+		INTON;
         }
 	nlpp = &bqlist;
 	while (*nlpp)
@@ -1435,6 +1439,12 @@ done:
 		str = NULL;
 		INTON;
 	}
+	if (ostr) {
+		INTOFF;
+		ckfree(ostr);
+		ostr = NULL;
+		INTON;
+	}
 	handler = savehandler;
 	if (arinest || dblquote)
 		USTPUTC(CTLBACKQ | CTLQUOTE, out);