d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

In reallocf(3), free the memory only when size != 0. Otherwise, when the

Browse Source 
System V compatibility option (malloc "V" flag) is in effect a zero sized
reallocf() could cause a double free.

PR:		bin/141753
Submitted by:	Dan Lukes
This commit is contained in:
jh 2010-03-03 15:43:26 +00:00
parent acf511e4d0
commit c5a3b40d67
1 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
lib/libc/stdlib/reallocf.c
View File

@ -35,7 +35,14 @@ reallocf(void *ptr, size_t size)
void *nptr;
nptr = realloc(ptr, size);
if (!nptr && ptr)
/*
* When the System V compatibility option (malloc "V" flag) is
* in effect, realloc(ptr, 0) frees the memory and returns NULL.
* So, to avoid double free, call free() only when size != 0.
* realloc(ptr, 0) can't fail when ptr != NULL.
*/
if (!nptr && ptr && size != 0)
free(ptr);
return (nptr);
}