* stdio-common/vfprintf.c (vfprintf): Check malloc return; don't

	call free(NULL).

2 files changed, 19 insertions, 5 deletions

diff --git a/ChangeLog b/ChangeLog
index dff539892b..b1e02a7123 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,8 +1,13 @@
+2013-03-05  Paul Pluzhnikov  <ppluzhnikov@google.com>
+
+	* stdio-common/vfprintf.c (vfprintf): Check malloc return; don't
+	call free(NULL).
+
 2013-03-05  David S. Miller  <davem@davemloft.net>
 
 	* po/es.po: Update from translation team.
 
-2013-03-04  Andreas Jaeger  <aj@suse.de>
+2013-03-05  Andreas Jaeger  <aj@suse.de>
 
 	* sysdeps/unix/sysv/linux/s390/bits/mman.h: Include
 	<bits/mman-linux.h>.
diff --git a/stdio-common/vfprintf.c b/stdio-common/vfprintf.c
index 89126d2d0a..7042090268 100644
--- a/stdio-common/vfprintf.c
+++ b/stdio-common/vfprintf.c
@@ -1691,7 +1691,8 @@ do_positional:
     /* Just a counter.  */
     size_t cnt;
 
-    free (workstart);
+    if (__builtin_expect (workstart != NULL, 0))
+      free (workstart);
     workstart = NULL;
 
     if (grouping == (const char *) -1)
@@ -1944,6 +1945,11 @@ do_positional:
 	      {
 		workstart = (CHAR_T *) malloc ((MAX (prec, width) + 32)
 					       * sizeof (CHAR_T));
+		if (workstart == NULL)
+		  {
+		    done = -1;
+		    goto all_done;
+		  }
 		workend = workstart + (MAX (prec, width) + 32);
 	      }
 	  }
@@ -2021,7 +2027,8 @@ do_positional:
 	    break;
 	  }
 
-	free (workstart);
+	if (__builtin_expect (workstart != NULL, 0))
+	  free (workstart);
 	workstart = NULL;
 
 	/* Write the following constant string.  */
@@ -2032,8 +2039,10 @@ do_positional:
   }
 
 all_done:
-  free (args_malloced);
-  free (workstart);
+  if (__builtin_expect (args_malloced != NULL, 0))
+    free (args_malloced);
+  if (__builtin_expect (workstart != NULL, 0))
+    free (workstart);
   /* Unlock the stream.  */
   _IO_funlockfile (s);
   _IO_cleanup_region_end (0);