提交 c97679c6 编写于 作者: P Peter Krempa

util: buf: Fix memory leak in virBufferEscapeN

The conversion to VIR_AUTOFREE of 'escapeList' introduced memory leak of
the copied item to be escaped:

==17517== 2 bytes in 1 blocks are definitely lost in loss record 1 of 32
==17517==    at 0x483880B: malloc (vg_replace_malloc.c:309)
==17517==    by 0x54D666D: strdup (in /usr/lib64/libc-2.28.so)
==17517==    by 0x497663E: virStrdup (virstring.c:956)
==17517==    by 0x497663E: virStrdup (virstring.c:945)
==17517==    by 0x48F8853: virBufferEscapeN (virbuffer.c:707)
==17517==    by 0x403C9D: testBufEscapeN (virbuftest.c:383)
==17517==    by 0x405FA8: virTestRun (testutils.c:174)
==17517==    by 0x403A70: mymain (virbuftest.c:517)
==17517==    by 0x406BC9: virTestMain (testutils.c:1097)
==17517==    by 0x5470412: (below main) (in /usr/lib64/libc-2.28.so)

[...] (all other have same backtrace as it happens in a loop)

Fix it by reverting all the VIR_AUTO nonsense in this function as there
is exactly one place where it's handled.

This effectively reverts commits:
d0a92a03
96fbf6df
d261ed2fSigned-off-by: NPeter Krempa <pkrempa@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>
上级 a3d0d77e
...@@ -643,26 +643,11 @@ virBufferEscape(virBufferPtr buf, char escape, const char *toescape, ...@@ -643,26 +643,11 @@ virBufferEscape(virBufferPtr buf, char escape, const char *toescape,
} }
typedef struct _virBufferEscapePair virBufferEscapePair; struct virBufferEscapePair {
typedef virBufferEscapePair *virBufferEscapePairPtr;
struct _virBufferEscapePair {
char escape; char escape;
char *toescape; char *toescape;
}; };
static void
virBufferEscapePairFree(virBufferEscapePairPtr pair)
{
if (!pair)
return;
VIR_FREE(pair->toescape);
VIR_FREE(pair);
}
VIR_DEFINE_AUTOPTR_FUNC(virBufferEscapePair, virBufferEscapePairFree);
/** /**
* virBufferEscapeN: * virBufferEscapeN:
...@@ -688,8 +673,8 @@ virBufferEscapeN(virBufferPtr buf, ...@@ -688,8 +673,8 @@ virBufferEscapeN(virBufferPtr buf,
VIR_AUTOFREE(char *) escaped = NULL; VIR_AUTOFREE(char *) escaped = NULL;
char *out; char *out;
const char *cur; const char *cur;
virBufferEscapePair escapeItem; struct virBufferEscapePair escapeItem;
VIR_AUTOPTR(virBufferEscapePair) escapeList = NULL; struct virBufferEscapePair *escapeList = NULL;
size_t nescapeList = 0; size_t nescapeList = 0;
va_list ap; va_list ap;
...@@ -704,7 +689,7 @@ virBufferEscapeN(virBufferPtr buf, ...@@ -704,7 +689,7 @@ virBufferEscapeN(virBufferPtr buf,
va_start(ap, str); va_start(ap, str);
while ((escapeItem.escape = va_arg(ap, int))) { while ((escapeItem.escape = va_arg(ap, int))) {
if (VIR_STRDUP(escapeItem.toescape, va_arg(ap, char *)) < 0) { if (!(escapeItem.toescape = va_arg(ap, char *))) {
virBufferSetError(buf, errno); virBufferSetError(buf, errno);
goto cleanup; goto cleanup;
} }
...@@ -747,6 +732,7 @@ virBufferEscapeN(virBufferPtr buf, ...@@ -747,6 +732,7 @@ virBufferEscapeN(virBufferPtr buf,
cleanup: cleanup:
va_end(ap); va_end(ap);
VIR_FREE(escapeList);
} }
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册