Don't leak memnodes in apr_pvsprintf() if out of memory and no pool abort

function is set.


git-svn-id: https://svn.apache.org/repos/asf/apr/apr/trunk@1438940 13f79535-47bb-0310-9956-ffa450edef68

1 files changed, 13 insertions, 13 deletions

diff --git a/memory/unix/apr_pools.c b/memory/unix/apr_pools.c
index da8b21225..d6af9b210 100644
--- a/memory/unix/apr_pools.c
+++ b/memory/unix/apr_pools.c
@@ -1147,21 +1147,12 @@ APR_DECLARE(char *) apr_pvsprintf(apr_pool_t *pool, const char *fmt, va_list ap)
      * room to hold the NUL terminator.
      */
     if (ps.node->first_avail == ps.node->endp) {
-        if (psprintf_flush(&ps.vbuff) == -1) {
-            if (pool->abort_fn) {
-                pool->abort_fn(APR_ENOMEM);
-            }
-
-            return NULL;
-        }
+        if (psprintf_flush(&ps.vbuff) == -1)
+           goto error;
     }
 
-    if (apr_vformatter(psprintf_flush, &ps.vbuff, fmt, ap) == -1) {
-        if (pool->abort_fn)
-            pool->abort_fn(APR_ENOMEM);
-
-        return NULL;
-    }
+    if (apr_vformatter(psprintf_flush, &ps.vbuff, fmt, ap) == -1)
+        goto error;
 
     strp = ps.vbuff.curpos;
     *strp++ = '\0';
@@ -1207,6 +1198,15 @@ APR_DECLARE(char *) apr_pvsprintf(apr_pool_t *pool, const char *fmt, va_list ap)
     list_insert(active, node);
 
     return strp;
+
+error:
+    if (pool->abort_fn)
+        pool->abort_fn(APR_ENOMEM);
+    if (ps.got_a_new_node) {
+        ps.node->next = ps.free;
+        allocator_free(pool->allocator, ps.node);
+    }
+    return NULL;
 }