From 7a0418304ec70764fa215bef3599f5f735222075 Mon Sep 17 00:00:00 2001 From: dearblue Date: Fri, 18 Jan 2019 20:38:27 +0900 Subject: [PATCH] Fix memory leak for string object when out of memory The `mrb_str_pool()` function has a path to call `malloc()` twice. If occurs `NoMemoryError` exception in second `malloc()`, first `malloc()` pointer is not freed. --- src/state.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/src/state.c b/src/state.c index e678b37f3..9405d7efb 100644 --- a/src/state.c +++ b/src/state.c @@ -176,6 +176,8 @@ mrb_irep_free(mrb_state *mrb, mrb_irep *irep) mrb_free(mrb, irep); } +mrb_noreturn void mrb_raise_nomemory(mrb_state *mrb); + mrb_value mrb_str_pool(mrb_state *mrb, mrb_value str) { @@ -214,7 +216,11 @@ mrb_str_pool(mrb_state *mrb, mrb_value str) ns->as.ary[len] = '\0'; } else { - ns->as.heap.ptr = (char *)mrb_malloc(mrb, (size_t)len+1); + ns->as.heap.ptr = (char *)mrb_malloc_simple(mrb, (size_t)len+1); + if (!ns->as.heap.ptr) { + mrb_free(mrb, ns); + mrb_raise_nomemory(mrb); + } ns->as.heap.len = len; ns->as.heap.aux.capa = len; if (ptr) {