[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20260805075759.3521663-1-matthias.goergens@gmail.com>
Date: Wed, 5 Aug 2026 15:57:59 +0800
From: Matthias Goergens <matthias.goergens@...il.com>
To: musl@...ts.openwall.com
Cc: Matthias Goergens <matthias.goergens@...il.com>
Subject: [PATCH] wordexp: free word on vector allocation failure
getword allocates the next expanded word before the result vector is
grown. If realloc fails, that word has not been stored in the vector and
cannot be reached by wordfree, so returning WRDE_NOSPACE leaks it.
Free the exclusively owned word before leaving the loop. Existing
partial results and the returned error are unchanged.
---
src/misc/wordexp.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/src/misc/wordexp.c b/src/misc/wordexp.c
index db83a69f..db3e0067 100644
--- a/src/misc/wordexp.c
+++ b/src/misc/wordexp.c
@@ -136,7 +136,10 @@ static int do_wordexp(const char *s, wordexp_t *we, int flags)
if (i+1 >= l) {
l += l/2+10;
tmp = realloc(wv, l*sizeof(char *));
- if (!tmp) break;
+ if (!tmp) {
+ free(w);
+ break;
+ }
wv = tmp;
}
wv[i++] = w;
--
2.55.0
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
