Bug 26044 - vsprintf calls __swsetup, then __smakebuf, it allocates mem and never frees it
Summary: vsprintf calls __swsetup, then __smakebuf, it allocates mem and never frees it
Status: Closed FIXED
Alias: None
Product: Base System
Classification: Unclassified
Component: misc (show other bugs)
Version: 4.2-STABLE
Hardware: Any Any
: Normal Affects Only Me
Assignee: bill fumerola
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2001-03-24 05:10 UTC by miles
Modified: 2002-05-31 10:16 UTC (History)
0 users

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description miles 2001-03-24 05:10:01 UTC 
vsnprintf() has "FILE f" and sets "f._bf._base = str;" (where str is what the user passes in).  If user passes in NULL, __swsetup(&f) calls __smakebuf(&f), which allocates a buffer that isnt ever freed.
/usr/src/lib/libc/stdio/vsnprintf.c

Fix: 

if (!str) free(p._bf._base); /* just before the return (ret) */
How-To-Repeat: vsnprintf(NULL, 0, "yadda yadda!\n"); /* should do it */
Comment 1 assar freebsd_committer freebsd_triage 2001-06-16 06:46:30 UTC 
State Changed
From-To: open->closed

thanks.  fixed.
Comment 2 assar freebsd_committer freebsd_triage 2001-06-16 06:46:30 UTC 
Responsible Changed
From-To: freebsd-bugs->assar

I fixed it
Comment 3 bill fumerola freebsd_committer freebsd_triage 2002-05-30 18:37:24 UTC 
State Changed
From-To: closed->open

this bug still exists.
Comment 4 bill fumerola freebsd_committer freebsd_triage 2002-05-30 18:37:24 UTC 
Responsible Changed
From-To: assar->freebsd-bugs

this bug still exists.
Comment 5 Maxim Konovalov 2002-05-31 10:01:44 UTC 
bin/36175 has a fix obtained from OpenBSD:

http://www.FreeBSD.org/cgi/query-pr.cgi?pr=bin/36175

On 10:38-0700, May 30, 2002, billf@FreeBSD.ORG wrote:

> Synopsis: vsprintf calls __swsetup, then __smakebuf, it allocates mem and never frees it
>
> State-Changed-From-To: closed->open
> State-Changed-By: billf
> State-Changed-When: Thu May 30 10:37:24 PDT 2002
> State-Changed-Why:
> this bug still exists.
>
>
> Responsible-Changed-From-To: assar->freebsd-bugs
> Responsible-Changed-By: billf
> Responsible-Changed-When: Thu May 30 10:37:24 PDT 2002
> Responsible-Changed-Why:
> this bug still exists.
>
> http://www.freebsd.org/cgi/query-pr.cgi?pr=26044
>
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-bugs" in the body of the message
>
>

-- 
Maxim Konovalov, MAcomnet, Internet Dept., system engineer
phone: +7 (095) 796-9079, mailto:maxim@macomnet.ru
Comment 6 bill fumerola freebsd_committer freebsd_triage 2002-05-31 10:15:57 UTC 
State Changed
From-To: open->closed

see pr# 36175
Comment 7 bill fumerola freebsd_committer freebsd_triage 2002-05-31 10:15:57 UTC 
Responsible Changed
From-To: freebsd-bugs->billf

see pr# 36175