nobu	2018-05-11 22:01:36 +0900 (Fri, 11 May 2018)

  New Revision: 63397

  https://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=63397

  Log:
    fix potential memory leaks
    
    * parse.y (primary, new_args_tail, local_tbl): keep the order;
      allocate an empty imemo first then xmalloc, to get rid of
      potential memory leak when allocation imemo failed.

  Modified files:
    trunk/parse.y
Index: parse.y
===================================================================
--- parse.y	(revision 63396)
+++ parse.y	(revision 63397)
@@ -278,6 +278,9 @@ struct parser_params { https://github.com/ruby/ruby/blob/trunk/parse.y#L278
 #endif
 };
 
+#define new_tmpbuf() \
+    (rb_imemo_tmpbuf_t *)add_mark_object(p, rb_imemo_tmpbuf_auto_free_pointer(NULL))
+
 #define intern_cstr(n,l,en) rb_intern3(n,l,en)
 
 #define STR_NEW(ptr,len) rb_enc_str_new((ptr),(len),p->enc)
@@ -2511,9 +2514,10 @@ primary		: literal https://github.com/ruby/ruby/blob/trunk/parse.y#L2514
 			ID id = internal_id(p);
 			NODE *m = NEW_ARGS_AUX(0, 0, &NULL_LOC);
 			NODE *args, *scope, *internal_var = NEW_DVAR(id, &@2);
+			rb_imemo_tmpbuf_t *tmpbuf = new_tmpbuf();
 			ID *tbl = ALLOC_N(ID, 2);
 			tbl[0] = 1 /* length of local var table */; tbl[1] = id /* internal id */;
-			add_mark_object(p, rb_imemo_tmpbuf_auto_free_pointer(tbl));
+			tmpbuf->ptr = (VALUE *)tbl;
 
 			switch (nd_type($2)) {
 			  case NODE_LASGN:
@@ -9994,9 +9998,10 @@ new_args_tail(struct parser_params *p, N https://github.com/ruby/ruby/blob/trunk/parse.y#L9998
     int saved_line = p->ruby_sourceline;
     struct rb_args_info *args;
     NODE *node;
+    rb_imemo_tmpbuf_t *tmpbuf = new_tmpbuf();
 
     args = ZALLOC(struct rb_args_info);
-    add_mark_object(p, rb_imemo_tmpbuf_auto_free_pointer(args));
+    tmpbuf->ptr = (VALUE *)args;
     node = NEW_NODE(NODE_ARGS, 0, 0, args, &NULL_LOC);
     if (p->error_p) return node;
 
@@ -10344,9 +10349,11 @@ local_tbl(struct parser_params *p) https://github.com/ruby/ruby/blob/trunk/parse.y#L10349
     int cnt = cnt_args + cnt_vars;
     int i, j;
     ID *buf;
+    rb_imemo_tmpbuf_t *tmpbuf = new_tmpbuf();
 
     if (cnt <= 0) return 0;
     buf = ALLOC_N(ID, cnt + 1);
+    tmpbuf->ptr = (void *)buf;
     MEMCPY(buf+1, p->lvtbl->args->tbl, ID, cnt_args);
     /* remove IDs duplicated to warn shadowing */
     for (i = 0, j = cnt_args+1; i < cnt_vars; ++i) {
@@ -10355,11 +10362,9 @@ local_tbl(struct parser_params *p) https://github.com/ruby/ruby/blob/trunk/parse.y#L10362
 	    buf[j++] = id;
 	}
     }
-    if (--j < cnt) REALLOC_N(buf, ID, (cnt = j) + 1);
+    if (--j < cnt) tmpbuf->ptr = (void *)REALLOC_N(buf, ID, (cnt = j) + 1);
     buf[0] = cnt;
 
-    add_mark_object(p, rb_imemo_tmpbuf_auto_free_pointer(buf));
-
     return buf;
 }
 #endif

--
ML: ruby-changes@q...
Info: http://www.atdot.net/~ko1/quickml/