From 6e06d6440bc91dff08fdd7f07181468ebb1b39b3 Mon Sep 17 00:00:00 2001
From: nobu <nobu@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>
Date: Wed, 9 May 2018 17:40:04 +0000
Subject: [PATCH] fix potential memory leaks

* gc.c (rb_alloc_tmp_buffer_with_count): keep the order; allocate
  an empty imemo first then xmalloc, to get rid of potential
  memory leak when allocation imemo failed.

* parse.y (rb_parser_malloc, rb_parser_calloc, rb_parser_realloc):
  ditto.

* process.c (rb_execarg_allocate_dup2_tmpbuf): ditto.

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@63385 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
---
 gc.c      | 10 +++++++++-
 parse.y   | 20 +++++++++++++-------
 process.c |  8 +++-----
 3 files changed, 25 insertions(+), 13 deletions(-)

diff --git a/gc.c b/gc.c
index 1d7ad561f4..bd52966bf1 100644
--- a/gc.c
+++ b/gc.c
@@ -8141,9 +8141,17 @@ void *
 rb_alloc_tmp_buffer_with_count(volatile VALUE *store, size_t size, size_t cnt)
 {
     void *ptr;
+    VALUE imemo;
+    rb_imemo_tmpbuf_t *tmpbuf;
 
+    /* Keep the order; allocate an empty imemo first then xmalloc, to
+     * get rid of potential memory leak */
+    imemo = rb_imemo_tmpbuf_auto_free_maybe_mark_buffer(NULL, 0);
+    *store = imemo;
     ptr = ruby_xmalloc0(size);
-    *store = rb_imemo_tmpbuf_auto_free_maybe_mark_buffer(ptr, cnt);
+    tmpbuf = (rb_imemo_tmpbuf_t *)imemo;
+    tmpbuf->ptr = ptr;
+    tmpbuf->cnt = cnt;
     return ptr;
 }
 
diff --git a/parse.y b/parse.y
index fa9348d646..f134e15270 100644
--- a/parse.y
+++ b/parse.y
@@ -10968,24 +10968,30 @@ rb_parser_set_yydebug(VALUE self, VALUE flag)
 #ifndef RIPPER
 #ifdef YYMALLOC
 #define HEAPCNT(n, size) ((n) * (size) / sizeof(YYSTYPE))
-#define ADD2HEAP(new, cnt, ptr) (p->heap = (new), (new)->cnt = (cnt), (ptr))
+/* Keep the order; NEWHEAP then xmalloc and ADD2HEAP to get rid of
+ * potential memory leak */
+#define NEWHEAP() rb_imemo_tmpbuf_parser_heap(0, p->heap, 0)
+#define ADD2HEAP(new, cnt, ptr) ((p->heap = (new))->ptr = (ptr), \
+			   (new)->cnt = (cnt), (ptr))
 
 void *
 rb_parser_malloc(struct parser_params *p, size_t size)
 {
     size_t cnt = HEAPCNT(1, size);
+    rb_imemo_tmpbuf_t *n = NEWHEAP();
     void *ptr = xmalloc(size);
-    p->heap = rb_imemo_tmpbuf_parser_heap(ptr, p->heap, cnt);
-    return p->heap->ptr;
+
+    return ADD2HEAP(n, cnt, ptr);
 }
 
 void *
 rb_parser_calloc(struct parser_params *p, size_t nelem, size_t size)
 {
     size_t cnt = HEAPCNT(nelem, size);
+    rb_imemo_tmpbuf_t *n = NEWHEAP();
     void *ptr = xcalloc(nelem, size);
-    p->heap = rb_imemo_tmpbuf_parser_heap(ptr, p->heap, cnt);
-    return p->heap->ptr;
+
+    return ADD2HEAP(n, cnt, ptr);
 }
 
 void *
@@ -11003,9 +11009,9 @@ rb_parser_realloc(struct parser_params *p, void *ptr, size_t size)
 	    }
 	} while ((n = n->next) != NULL);
     }
+    n = NEWHEAP();
     ptr = xrealloc(ptr, size);
-    p->heap = rb_imemo_tmpbuf_parser_heap(ptr, p->heap, cnt);
-    return p->heap->ptr;
+    return ADD2HEAP(n, cnt, ptr);
 }
 
 void
diff --git a/process.c b/process.c
index 5601d82cdc..c1c8432a45 100644
--- a/process.c
+++ b/process.c
@@ -2358,11 +2358,9 @@ open_func(void *ptr)
 static void
 rb_execarg_allocate_dup2_tmpbuf(struct rb_execarg *eargp, long len)
 {
-    eargp->dup2_tmpbuf =
-        rb_imemo_tmpbuf_auto_free_pointer(
-            ruby_xmalloc(
-                run_exec_dup2_tmpbuf_size(
-                    len)));
+    VALUE tmpbuf = rb_imemo_tmpbuf_auto_free_pointer(NULL);
+    ((rb_imemo_tmpbuf_t *)tmpbuf)->ptr = ruby_xmalloc(run_exec_dup2_tmpbuf_size(len));
+    eargp->dup2_tmpbuf = tmpbuf;
 }
 
 static VALUE