Possible bug in __sfp() libc routine

[Kapania, Ashish]

Hi All,

In the __sfp() function in "libc/findfp.c" file, I see that if no free FILE object is found, one is allocated and put on a list in the global re-entrancy structure (_GLOBAL_REENT). This seems like a bug to me. I believe the FILE object should be put on a list in the thread specific reentrancy structure. If I create a thread, do a fopen, do a fwrite (invokes __sfp which in turn allocates the FILE object), do a fclose and then delete the thread, the FILE object allocated by __sfp() is not freed. If a do this sequence repeatedly, I see memory keeps leaking until my app runs out of heap. I have a separate re-entrancy structure for each thread but because the FILE object is not in a list on the local re-entrancy structure, it does not get freed when I delete the thread and run _reclaim_reent() on the local reentrancy structure.

Any thoughts ?

Best,
Ashish