Protect freelists managed by Balloc/Bfree with a spinlock.

Change __dtoa to not free the string it allocated the previous time it was
called.  The caller now frees the string after usage if appropiate.

PR:		15070

1 files changed, 18 insertions, 5 deletions

diff --git a/lib/libc/stdio/vfprintf.c b/lib/libc/stdio/vfprintf.c
index fff9aa8..afb10b0 100644
--- a/lib/libc/stdio/vfprintf.c
+++ b/lib/libc/stdio/vfprintf.c
@@ -267,7 +267,7 @@ vfprintf(FILE *fp, const char *fmt0, va_list ap)
 #define	BUF		(MAXEXP+MAXFRACT+1)	/* + decimal point */
 #define	DEFPREC		6
 
-static char *cvt __P((double, int, int, char *, int *, int, int *));
+static char *cvt __P((double, int, int, char *, int *, int, int *, char **));
 static int exponent __P((char *, int, int));
 
 #else /* no FLOATING_POINT */
@@ -313,6 +313,7 @@ __vfprintf(FILE *fp, const char *fmt0, va_list ap)
 	int expsize;		/* character count for expstr */
 	int ndig;		/* actual number of digits returned by cvt */
 	char expstr[7];		/* buffer for exponent string */
+	char *dtoaresult;	/* buffer allocated by dtoa */
 #endif
 	u_long	ulval;		/* integer arguments %[diouxX] */
 	u_quad_t uqval;		/* %q integers */
@@ -421,6 +422,9 @@ __vfprintf(FILE *fp, const char *fmt0, va_list ap)
         }
         
 
+#ifdef FLOATING_POINT
+	dtoaresult = NULL;
+#endif
 	/* sorry, fprintf(read_only_file, "") returns EOF, not 0 */
 	if (cantwrite(fp))
 		return (EOF);
@@ -606,8 +610,12 @@ fp_begin:		if (prec == -1)
 				break;
 			}
 			flags |= FPT;
+			if (dtoaresult != NULL) {
+				free(dtoaresult);
+				dtoaresult = NULL;
+			}
 			cp = cvt(_double, prec, flags, &softsign,
-				&expt, ch, &ndig);
+				&expt, ch, &ndig, &dtoaresult);
 			if (ch == 'g' || ch == 'G') {
 				if (expt <= -4 || expt > prec)
 					ch = (ch == 'g') ? 'e' : 'E';
@@ -863,6 +871,10 @@ number:			if ((dprec = prec) >= 0)
 done:
 	FLUSH();
 error:
+#ifdef FLOATING_POINT
+	if (dtoaresult != NULL)
+		free(dtoaresult);
+#endif
 	if (__sferror(fp))
 		ret = EOF;
         if ((argtable != NULL) && (argtable != statargtable))
@@ -1194,11 +1206,11 @@ __grow_type_table (int nextarg, unsigned char **typetable, int *tablesize)
 
 #ifdef FLOATING_POINT
 
-extern char *__dtoa __P((double, int, int, int *, int *, char **));
+extern char *__dtoa __P((double, int, int, int *, int *, char **, char **));
 
 static char *
 cvt(double value, int ndigits, int flags, char *sign, int *decpt,
-    int ch, int *length)
+    int ch, int *length, char **dtoaresultp)
 {
 	int mode, dsgn;
 	char *digits, *bp, *rve;
@@ -1220,7 +1232,8 @@ cvt(double value, int ndigits, int flags, char *sign, int *decpt,
 		*sign = '-';
 	} else
 		*sign = '\000';
-	digits = __dtoa(value, mode, ndigits, decpt, &dsgn, &rve);
+	digits = __dtoa(value, mode, ndigits, decpt, &dsgn, &rve,
+			dtoaresultp);
 	if ((ch != 'g' && ch != 'G') || flags & ALT) {
 		/* print trailing zeros */
 		bp = digits + ndigits;