sys-apps/groff/files/groff-1.20.1-double-frees-mem-leaks.patch

https://bugs.gentoo.org/294045

From be095a293e09eae67254f59ce878b1a36233b447 Mon Sep 17 00:00:00 2001
From: wl <wl>
Date: Tue, 24 Nov 2009 13:32:17 +0000
Subject: [PATCH] Fix double frees and memory leaks.

* src/roff/troff/env.cpp (environment::make_tag): Use local object.
* src/roff/troff/input.cpp (input_stack::check_end_diversion): Free
`diversion_state' here.
(interpolate_arg): Fix memory leaks.
* src/roff/troff/mtsm.cpp (mtsm::pop_state): Don't free `sp->state'.
---
 ChangeLog                |   10 ++++++++++
 src/roff/troff/env.cpp   |   13 +++++++------
 src/roff/troff/input.cpp |    5 +++++
 src/roff/troff/mtsm.cpp  |    2 --
 4 files changed, 22 insertions(+), 8 deletions(-)

diff --git a/src/roff/troff/env.cpp b/src/roff/troff/env.cpp
index 56bfe21..13672cc 100644
--- a/src/roff/troff/env.cpp
+++ b/src/roff/troff/env.cpp
@@ -2213,14 +2213,15 @@ node *environment::make_tag(const char *nm, int i)
      */
     if (curdiv == topdiv && topdiv->before_first_page)
       topdiv->begin_page();
-    macro *m = new macro;
-    m->append_str("devtag:");
+
+    macro m;
+    m.append_str("devtag:");
     for (const char *p = nm; *p; p++)
       if (!invalid_input_char((unsigned char)*p))
-	m->append(*p);
-    m->append(' ');
-    m->append_int(i);
-    return new special_node(*m);
+	m.append(*p);
+    m.append(' ');
+    m.append_int(i);
+    return new special_node(m);
   }
   return 0;
 }
diff --git a/src/roff/troff/input.cpp b/src/roff/troff/input.cpp
index 17d2451..7c816e8 100644
--- a/src/roff/troff/input.cpp
+++ b/src/roff/troff/input.cpp
@@ -531,6 +531,8 @@ void input_stack::check_end_diversion(input_iterator *t)
 {
   if (t->is_diversion) {
     div_level--;
+    if (diversion_state)
+      delete diversion_state;
     diversion_state = t->diversion_state;
   }
 }
@@ -4398,6 +4400,7 @@ static void interpolate_arg(symbol nm)
 	  args += c;
       if (i != limit)
 	args += ' ';
+      delete p;
     }
     if (limit > 0) {
       args += '\0';
@@ -4419,6 +4422,7 @@ static void interpolate_arg(symbol nm)
       args += '"';
       if (i != limit)
 	args += ' ';
+      delete p;
     }
     if (limit > 0) {
       args += '\0';
@@ -4438,6 +4442,7 @@ static void interpolate_arg(symbol nm)
       }
       if (input_stack::space_follows_arg(i))
 	args += ' ';
+      delete p;
     }
     if (limit > 0) {
       args += '\0';
diff --git a/src/roff/troff/mtsm.cpp b/src/roff/troff/mtsm.cpp
index 83a6906..79e2f78 100644
--- a/src/roff/troff/mtsm.cpp
+++ b/src/roff/troff/mtsm.cpp
@@ -390,8 +390,6 @@ void mtsm::pop_state()
 #endif
     if (sp == 0)
       fatal("empty state machine stack");
-    if (sp->state)
-      delete sp->state;
     sp->state = 0;
     stack *t = sp;
     sp = sp->next;
-- 
1.7.1.1