BUG #10976: Two memory leaks in regcomp cleanup - Mailing list pgsql-bugs

From arthur.j.odwyer@gmail.com
Subject BUG #10976: Two memory leaks in regcomp cleanup
Date
Msg-id 20140716193828.2503.81394@wrigleys.postgresql.org
Whole thread Raw
Responses Re: BUG #10976: Two memory leaks in regcomp cleanup
List pgsql-bugs
The following bug has been logged on the website:

Bug reference:      10976
Logged by:          Arthur O'Dwyer
Email address:      arthur.j.odwyer@gmail.com
PostgreSQL version: 9.3.0
Operating system:   Ubuntu Linux
Description:

When MALLOC fails, pg_regcomp leaks memory in at least two places:

(A) In freev(), the line
    freesubre(info, v, v->tree);
should be
    freesubre(info, NULL, v->tree);
as otherwise the "freed" subres will end up on v->treefree, which is leaked
by the cleanst() two lines later.
That is, given the precondition that there are things in v->tree that aren't
in v->treechain.
This precondition is invariably true if we are being called because
nfatree() has run out of memory here:

    markst(v->tree);
    cleanst(info, v);  /* clears v->treechain without clearing v->tree */
    [...some comments...]
    re->re_info |= nfatree(info, v, v->tree, debug);
    CNOERR();  /* calls freev() */

(B) newlacon() leaks memory if REALLOC returns NULL on this line:

    v->lacons = (struct subre *) REALLOC(v->lacons,
        (v->nlacons + 1) * sizeof(struct subre));

The fix is to use the same idiom already used everywhere else REALLOC is
called in this module.

pgsql-bugs by date:

Previous
From: Tom Lane
Date:
Subject: Re: SQLSTATE 00000 and message level LOG get logged when a server process crashes
Next
From: Pedro Gimeno
Date:
Subject: Re: Documentation problem: The syntax for "\copy" is just wrong