Fix memory handling in functions called from loadlocale

Signed-off by: Corinna Vinschen <corinna@vinschen.de>

6 files changed, 72 insertions, 23 deletions

diff --git a/newlib/libc/locale/lctype.c b/newlib/libc/locale/lctype.c
index 4185a8328..6e47b0469 100644
--- a/newlib/libc/locale/lctype.c
+++ b/newlib/libc/locale/lctype.c
@@ -74,13 +74,21 @@ __ctype_load_locale (struct __locale_t *locale, const char *name,
 	{
 	  ctp = (struct lc_ctype_T *) calloc (1, sizeof *ctp);
 	  if (!ctp)
-	    return -1;
-	  memcpy (ctp, &ct, sizeof *ctp);
+	    {
+	      free (bufp);
+	      return -1;
+	    }
+	  *ctp = ct;
 	}
+      struct __lc_cats tmp = locale->lc_cat[LC_CTYPE];
       locale->lc_cat[LC_CTYPE].ptr = ret == 0 ? &_C_ctype_locale : ctp;
-      if (locale->lc_cat[LC_CTYPE].buf)
-	free (locale->lc_cat[LC_CTYPE].buf);
       locale->lc_cat[LC_CTYPE].buf = bufp;
+      /* If buf is not NULL, both pointers have been alloc'ed */
+      if (tmp.buf)
+	{
+	  free ((void *) tmp.ptr);
+	  free (tmp.buf);
+	}
       ret = 0;
     }
 #elif !defined (__HAVE_LOCALE_INFO_EXTENDED__)
diff --git a/newlib/libc/locale/lmessages.c b/newlib/libc/locale/lmessages.c
index cea0c94c8..3780ffbba 100644
--- a/newlib/libc/locale/lmessages.c
+++ b/newlib/libc/locale/lmessages.c
@@ -84,13 +84,21 @@ __messages_load_locale (struct __locale_t *locale, const char *name,
 	{
 	  mep = (struct lc_messages_T *) calloc (1, sizeof *mep);
 	  if (!mep)
-	    return -1;
-	  memcpy (mep, &me, sizeof *mep);
+	    {
+	      free (bufp);
+	      return -1;
+	    }
+	  *mep = me;
 	}
+      struct __lc_cats tmp = locale->lc_cat[LC_MESSAGES];
       locale->lc_cat[LC_MESSAGES].ptr = ret == 0 ? &_C_messages_locale : mep;
-      if (locale->lc_cat[LC_MESSAGES].buf)
-	free (locale->lc_cat[LC_MESSAGES].buf);
       locale->lc_cat[LC_MESSAGES].buf = bufp;
+      /* If buf is not NULL, both pointers have been alloc'ed */
+      if (tmp.buf)
+	{
+	  free ((void *) tmp.ptr);
+	  free (tmp.buf);
+	}
       ret = 0;
     }
 #else
diff --git a/newlib/libc/locale/lmonetary.c b/newlib/libc/locale/lmonetary.c
index ab770a0fd..b7077a060 100644
--- a/newlib/libc/locale/lmonetary.c
+++ b/newlib/libc/locale/lmonetary.c
@@ -112,13 +112,21 @@ __monetary_load_locale (struct __locale_t *locale, const char *name ,
 	{
 	  mop = (struct lc_monetary_T *) calloc (1, sizeof *mop);
 	  if (!mop)
-	    return -1;
-	  memcpy (mop, &mo, sizeof *mop);
+	    {
+	      free (bufp);
+	      return -1;
+	    }
+	  *mop = mo;
 	}
+      struct __lc_cats tmp = locale->lc_cat[LC_MONETARY];
       locale->lc_cat[LC_MONETARY].ptr = ret == 0 ? &_C_monetary_locale : mop;
-      if (locale->lc_cat[LC_MONETARY].buf)
-	free (locale->lc_cat[LC_MONETARY].buf);
       locale->lc_cat[LC_MONETARY].buf = bufp;
+      /* If buf is not NULL, both pointers have been alloc'ed */
+      if (tmp.buf)
+	{
+	  free ((void *) tmp.ptr);
+	  free (tmp.buf);
+	}
       ret = 0;
     }
 #else
diff --git a/newlib/libc/locale/lnumeric.c b/newlib/libc/locale/lnumeric.c
index c488584f3..c63fd8e0f 100644
--- a/newlib/libc/locale/lnumeric.c
+++ b/newlib/libc/locale/lnumeric.c
@@ -74,13 +74,21 @@ __numeric_load_locale (struct __locale_t *locale, const char *name ,
 	{
 	  nmp = (struct lc_numeric_T *) calloc (1, sizeof *nmp);
 	  if (!nmp)
-	    return -1;
-	  memcpy (nmp, &nm, sizeof *nmp);
+	    {
+	      free (bufp);
+	      return -1;
+	    }
+	  *nmp = nm;
 	}
+      struct __lc_cats tmp = locale->lc_cat[LC_NUMERIC];
       locale->lc_cat[LC_NUMERIC].ptr = ret == 0 ? &_C_numeric_locale : nmp;
-      if (locale->lc_cat[LC_NUMERIC].buf)
-	free (locale->lc_cat[LC_NUMERIC].buf);
       locale->lc_cat[LC_NUMERIC].buf = bufp;
+      /* If buf is not NULL, both pointers have been alloc'ed */
+      if (tmp.buf)
+	{
+	  free ((void *) tmp.ptr);
+	  free (tmp.buf);
+	}
       ret = 0;
     }
 #else
diff --git a/newlib/libc/locale/locale.c b/newlib/libc/locale/locale.c
index 4f2d6d271..f6e9a9718 100644
--- a/newlib/libc/locale/locale.c
+++ b/newlib/libc/locale/locale.c
@@ -1152,7 +1152,10 @@ error:
   for (i = 1; i < _LC_LAST; ++i)
     if (tmp_locale.lc_cat[i].buf
 	&& tmp_locale.lc_cat[i].buf != (const void *) -1)
-      _free_r (p, tmp_locale.lc_cat[i].buf);
+      {
+	_free_r (p, tmp_locale.lc_cat[i].ptr);
+	_free_r (p, tmp_locale.lc_cat[i].buf);
+      }
 #endif
 
   return NULL;
@@ -1167,7 +1170,10 @@ _freelocale_r (struct _reent *p, struct __locale_t *locobj)
 #ifdef __HAVE_LOCALE_INFO__
   for (int i = 1; i < _LC_LAST; ++i)
     if (locobj->lc_cat[i].buf)
-      _free_r (p, locobj->lc_cat[i].buf);
+      {
+	_free_r (p, locobj->lc_cat[i].ptr);
+	_free_r (p, locobj->lc_cat[i].buf);
+      }
 #endif
   _free_r (p, locobj);
 }
@@ -1212,7 +1218,10 @@ error:
 #ifdef __HAVE_LOCALE_INFO__
   while (--i > 0)
     if (tmp_locale.lc_cat[i].buf)
-      _free_r (p, tmp_locale.lc_cat[i].buf);
+      {
+	_free_r (p, tmp_locale.lc_cat[i].ptr);
+	_free_r (p, tmp_locale.lc_cat[i].buf);
+      }
 #endif
 
   return NULL;
diff --git a/newlib/libc/locale/timelocal.c b/newlib/libc/locale/timelocal.c
index d9760f0ff..1c869e1a3 100644
--- a/newlib/libc/locale/timelocal.c
+++ b/newlib/libc/locale/timelocal.c
@@ -174,13 +174,21 @@ __time_load_locale (struct __locale_t *locale, const char *name,
 	{
 	  tip = (struct lc_time_T *) calloc (1, sizeof *tip);
 	  if (!tip)
-	    return -1;
-	  memcpy (tip, &ti, sizeof *tip);
+	    {
+	      free (bufp);
+	      return -1;
+	    }
+	  *tip = ti;
 	}
+      struct __lc_cats tmp = locale->lc_cat[LC_TIME];
       locale->lc_cat[LC_TIME].ptr = ret == 0 ? &_C_time_locale : tip;
-      if (locale->lc_cat[LC_TIME].buf)
-	free (locale->lc_cat[LC_TIME].buf);
       locale->lc_cat[LC_TIME].buf = bufp;
+      /* If buf is not NULL, both pointers have been alloc'ed */
+      if (tmp.buf)
+	{
+	  free ((void *) tmp.ptr);
+	  free (tmp.buf);
+	}
       ret = 0;
     }
 #else