[bug-diffutils] Memory leak and memory errors in cmp

[Karl Lindén]

Hi!

There is a memory leak in diffutils' cmp program and possibly two
memory errors due to uninitialized variables. When I run cmp in
valgrind using two identical files I get this:

$ valgrind --leak-check=full --show-reachable=yes --track-origins=yes
cmp testfile1.txt testfile2.txt
==5472== Memcheck, a memory error detector
==5472== Copyright (C) 2002-2012, and GNU GPL'd, by Julian Seward et al.
==5472== Using Valgrind-3.8.1 and LibVEX; rerun with -h for copyright info
==5472== Command: cmp testfile1.txt testfile2.txt
==5472==
==5472== Conditional jump or move depends on uninitialised value(s)
==5472==    at 0x4024C5: main (cmp.c:596)
==5472==  Uninitialised value was created by a heap allocation
==5472==    at 0x4A099EB: malloc (vg_replace_malloc.c:270)
==5472==    by 0x404968: xmalloc (xmalloc.c:41)
==5472==    by 0x40211B: main (cmp.c:359)
==5472==
==5472== Conditional jump or move depends on uninitialised value(s)
==5472==    at 0x402514: main (cmp.c:609)
==5472==  Uninitialised value was created by a heap allocation
==5472==    at 0x4A099EB: malloc (vg_replace_malloc.c:270)
==5472==    by 0x404968: xmalloc (xmalloc.c:41)
==5472==    by 0x40211B: main (cmp.c:359)
==5472==
==5472==
==5472== HEAP SUMMARY:
==5472==     in use at exit: 8,208 bytes in 1 blocks
==5472==   total heap usage: 68 allocs, 67 frees, 59,106 bytes allocated
==5472==
==5472== 8,208 bytes in 1 blocks are still reachable in loss record 1 of 1
==5472==    at 0x4A099EB: malloc (vg_replace_malloc.c:270)
==5472==    by 0x404968: xmalloc (xmalloc.c:41)
==5472==    by 0x40211B: main (cmp.c:359)
==5472==
==5472== LEAK SUMMARY:
==5472==    definitely lost: 0 bytes in 0 blocks
==5472==    indirectly lost: 0 bytes in 0 blocks
==5472==      possibly lost: 0 bytes in 0 blocks
==5472==    still reachable: 8,208 bytes in 1 blocks
==5472==         suppressed: 0 bytes in 0 blocks
==5472==
==5472== For counts of detected and suppressed errors, rerun with: -v
==5472== ERROR SUMMARY: 2 errors from 2 contexts (suppressed: 2 from 2)

I'm running diffutils-3.3 on Gentoo. The distribution of diffutils is
unpatched except for a sed call which does not affected the source
files.

The memory leak is reproducible even with differing files, but the
error is only reproducible only with identical files.

The memory leak is easily fixed by calling free() after the cmp() call
in main. Please see the attached patch. However, I have no idea how to
fix the memory error.

Thanks,
Karl

diffutils-3.3-missing-free.patch
Description: Binary data