Odd free in libio/genops.c

[Martin Schwidefsky]

Hi,
we stumbled across a strange free in the libio code. If _IO_default_finish
is called while the backup area is active, the backup area is freed which
was not allocated with malloc. There should be something like the following:

Index: genops.c
===================================================================
RCS file: /cvs/glibc/libc/libio/genops.c,v
retrieving revision 1.51
diff -u -r1.51 genops.c
--- genops.c   2001/08/11 05:11:52 1.51
+++ genops.c   2001/08/17 14:13:24
@@ -663,6 +663,9 @@
   for (mark = fp->_markers; mark != NULL; mark = mark->_next)
     mark->_sbuf = NULL;

+  if (_IO_in_backup (fp))
+    _IO_switch_to_main_get_area (fp);  /* Just in case. */
+
   if (fp->_IO_save_base)
     {
       free (fp->_IO_save_base);

blue skies,
   Martin

Linux/390 Design & Development, IBM Deutschland Entwicklung GmbH
Schönaicherstr. 220, D-71032 Böblingen, Telefon: 49 - (0)7031 - 16-2247
E-Mail: schwidefsky@de.ibm.com