From c5a3b40d67289d8bb591d76ed3c0d1b8ad5715a8 Mon Sep 17 00:00:00 2001 From: jh Date: Wed, 3 Mar 2010 15:43:26 +0000 Subject: In reallocf(3), free the memory only when size != 0. Otherwise, when the System V compatibility option (malloc "V" flag) is in effect a zero sized reallocf() could cause a double free. PR: bin/141753 Submitted by: Dan Lukes --- lib/libc/stdlib/reallocf.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) (limited to 'lib/libc/stdlib/reallocf.c') diff --git a/lib/libc/stdlib/reallocf.c b/lib/libc/stdlib/reallocf.c index 5320926..a85b5a3 100644 --- a/lib/libc/stdlib/reallocf.c +++ b/lib/libc/stdlib/reallocf.c @@ -35,7 +35,14 @@ reallocf(void *ptr, size_t size) void *nptr; nptr = realloc(ptr, size); - if (!nptr && ptr) + + /* + * When the System V compatibility option (malloc "V" flag) is + * in effect, realloc(ptr, 0) frees the memory and returns NULL. + * So, to avoid double free, call free() only when size != 0. + * realloc(ptr, 0) can't fail when ptr != NULL. + */ + if (!nptr && ptr && size != 0) free(ptr); return (nptr); } -- cgit v1.1