free memory that gets allocated by vfprintf when str == NULL

PR:		misc/26044

MFC after:	1 week

4 files changed, 8 insertions, 0 deletions

diff --git a/lib/libc/stdio/snprintf.c b/lib/libc/stdio/snprintf.c
index fe21129..3463c05 100644
--- a/lib/libc/stdio/snprintf.c
+++ b/lib/libc/stdio/snprintf.c
@@ -87,5 +87,7 @@ snprintf(str, n, fmt, va_alist)
 	if (on > 0)
 		*f._p = '\0';
 	va_end(ap);
+	if (str == NULL)
+		free(f._bf._base);
 	return (ret);
 }
diff --git a/lib/libc/stdio/sprintf.c b/lib/libc/stdio/sprintf.c
index a810096..04910e0 100644
--- a/lib/libc/stdio/sprintf.c
+++ b/lib/libc/stdio/sprintf.c
@@ -77,5 +77,7 @@ sprintf(str, fmt, va_alist)
 	ret = __vfprintf(&f, fmt, ap);
 	va_end(ap);
 	*f._p = 0;
+	if (str == NULL)
+		free(f._bf._base);
 	return (ret);
 }
diff --git a/lib/libc/stdio/vsnprintf.c b/lib/libc/stdio/vsnprintf.c
index b301b08..3b76259 100644
--- a/lib/libc/stdio/vsnprintf.c
+++ b/lib/libc/stdio/vsnprintf.c
@@ -69,5 +69,7 @@ vsnprintf(str, n, fmt, ap)
 	ret = __vfprintf(&f, fmt, ap);
 	if (on > 0)
 		*f._p = '\0';
+	if (str == NULL)
+		free(f._bf._base);
 	return (ret);
 }
diff --git a/lib/libc/stdio/vsprintf.c b/lib/libc/stdio/vsprintf.c
index dbfd339..9bcd075 100644
--- a/lib/libc/stdio/vsprintf.c
+++ b/lib/libc/stdio/vsprintf.c
@@ -61,5 +61,7 @@ vsprintf(str, fmt, ap)
 	f._bf._size = f._w = INT_MAX;
 	ret = __vfprintf(&f, fmt, ap);
 	*f._p = 0;
+	if (str == NULL)
+		free(f._bf._base);
 	return (ret);
 }