nobu	2018-05-10 02:40:04 +0900 (Thu, 10 May 2018)

  New Revision: 63385

  https://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=63385

  Log:
    fix potential memory leaks
    
    * gc.c (rb_alloc_tmp_buffer_with_count): keep the order; allocate
      an empty imemo first then xmalloc, to get rid of potential
      memory leak when allocation imemo failed.
    
    * parse.y (rb_parser_malloc, rb_parser_calloc, rb_parser_realloc):
      ditto.
    
    * process.c (rb_execarg_allocate_dup2_tmpbuf): ditto.

  Modified files:
    trunk/gc.c
    trunk/parse.y
    trunk/process.c
Index: parse.y
===================================================================
--- parse.y	(revision 63384)
+++ parse.y	(revision 63385)
@@ -10968,24 +10968,30 @@ rb_parser_set_yydebug(VALUE self, VALUE https://github.com/ruby/ruby/blob/trunk/parse.y#L10968
 #ifndef RIPPER
 #ifdef YYMALLOC
 #define HEAPCNT(n, size) ((n) * (size) / sizeof(YYSTYPE))
-#define ADD2HEAP(new, cnt, ptr) (p->heap = (new), (new)->cnt = (cnt), (ptr))
+/* Keep the order; NEWHEAP then xmalloc and ADD2HEAP to get rid of
+ * potential memory leak */
+#define NEWHEAP() rb_imemo_tmpbuf_parser_heap(0, p->heap, 0)
+#define ADD2HEAP(new, cnt, ptr) ((p->heap = (new))->ptr = (ptr), \
+			   (new)->cnt = (cnt), (ptr))
 
 void *
 rb_parser_malloc(struct parser_params *p, size_t size)
 {
     size_t cnt = HEAPCNT(1, size);
+    rb_imemo_tmpbuf_t *n = NEWHEAP();
     void *ptr = xmalloc(size);
-    p->heap = rb_imemo_tmpbuf_parser_heap(ptr, p->heap, cnt);
-    return p->heap->ptr;
+
+    return ADD2HEAP(n, cnt, ptr);
 }
 
 void *
 rb_parser_calloc(struct parser_params *p, size_t nelem, size_t size)
 {
     size_t cnt = HEAPCNT(nelem, size);
+    rb_imemo_tmpbuf_t *n = NEWHEAP();
     void *ptr = xcalloc(nelem, size);
-    p->heap = rb_imemo_tmpbuf_parser_heap(ptr, p->heap, cnt);
-    return p->heap->ptr;
+
+    return ADD2HEAP(n, cnt, ptr);
 }
 
 void *
@@ -11003,9 +11009,9 @@ rb_parser_realloc(struct parser_params * https://github.com/ruby/ruby/blob/trunk/parse.y#L11009
 	    }
 	} while ((n = n->next) != NULL);
     }
+    n = NEWHEAP();
     ptr = xrealloc(ptr, size);
-    p->heap = rb_imemo_tmpbuf_parser_heap(ptr, p->heap, cnt);
-    return p->heap->ptr;
+    return ADD2HEAP(n, cnt, ptr);
 }
 
 void
Index: process.c
===================================================================
--- process.c	(revision 63384)
+++ process.c	(revision 63385)
@@ -2358,11 +2358,9 @@ open_func(void *ptr) https://github.com/ruby/ruby/blob/trunk/process.c#L2358
 static void
 rb_execarg_allocate_dup2_tmpbuf(struct rb_execarg *eargp, long len)
 {
-    eargp->dup2_tmpbuf =
-        rb_imemo_tmpbuf_auto_free_pointer(
-            ruby_xmalloc(
-                run_exec_dup2_tmpbuf_size(
-                    len)));
+    VALUE tmpbuf = rb_imemo_tmpbuf_auto_free_pointer(NULL);
+    ((rb_imemo_tmpbuf_t *)tmpbuf)->ptr = ruby_xmalloc(run_exec_dup2_tmpbuf_size(len));
+    eargp->dup2_tmpbuf = tmpbuf;
 }
 
 static VALUE
Index: gc.c
===================================================================
--- gc.c	(revision 63384)
+++ gc.c	(revision 63385)
@@ -8141,9 +8141,17 @@ void * https://github.com/ruby/ruby/blob/trunk/gc.c#L8141
 rb_alloc_tmp_buffer_with_count(volatile VALUE *store, size_t size, size_t cnt)
 {
     void *ptr;
+    VALUE imemo;
+    rb_imemo_tmpbuf_t *tmpbuf;
 
+    /* Keep the order; allocate an empty imemo first then xmalloc, to
+     * get rid of potential memory leak */
+    imemo = rb_imemo_tmpbuf_auto_free_maybe_mark_buffer(NULL, 0);
+    *store = imemo;
     ptr = ruby_xmalloc0(size);
-    *store = rb_imemo_tmpbuf_auto_free_maybe_mark_buffer(ptr, cnt);
+    tmpbuf = (rb_imemo_tmpbuf_t *)imemo;
+    tmpbuf->ptr = ptr;
+    tmpbuf->cnt = cnt;
     return ptr;
 }
 

--
ML: ruby-changes@q...
Info: http://www.atdot.net/~ko1/quickml/