Page MenuHomeFreeBSD

heimdal: Pass the correct pointer to realloc when growing a string buffer
ClosedPublic

Authored by jhb on Jan 28 2026, 9:42 PM.
Tags
None
Referenced Files
Unknown Object (File)
Sat, Mar 21, 7:22 PM
Unknown Object (File)
Sun, Mar 15, 2:24 AM
Unknown Object (File)
Sun, Mar 15, 2:19 AM
Unknown Object (File)
Thu, Mar 12, 6:05 PM
Unknown Object (File)
Thu, Mar 12, 12:23 PM
Unknown Object (File)
Thu, Mar 12, 7:57 AM
Unknown Object (File)
Sat, Mar 7, 1:45 PM
Unknown Object (File)
Mon, Mar 2, 12:28 AM
Subscribers

Details

Summary

The realloc in my_fgetln was trying to grow the pointer to the string
buffer, not the string buffer itself.

In function 'my_fgetln',

inlined from 'mit_prop_dump' at crypto/heimdal/kdc/mit_dump.c:156:19:

crypto/heimdal/kdc/mit_dump.c:119:13: error: 'realloc' called on unallocated object 'line' [-Werror=free-nonheap-object]

119 |         n = realloc(buf, *sz + (*sz >> 1));
    |             ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

crypto/heimdal/kdc/mit_dump.c: In function 'mit_prop_dump':
crypto/heimdal/kdc/mit_dump.c:139:11: note: declared here

139 |     char *line = NULL;
    |           ^~~~

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

jhb requested review of this revision.Jan 28 2026, 9:42 PM

I know nothing about gcc flags, but if it gets
rid of the error, that seems fine to me.

This revision is now accepted and ready to land.Jan 31 2026, 4:38 AM

Oh, I misread the code. There is a real bug here. It is calling realloc on the wrong thing. I will upload a new diff in a sec.

jhb retitled this revision from heimdal: Silence a false positive warning from GCC 14 to heimdal: Pass the correct pointer to realloc when growing a string buffer.Jan 31 2026, 5:08 PM
jhb edited the summary of this revision. (Show Details)
This revision now requires review to proceed.Jan 31 2026, 5:08 PM
This revision is now accepted and ready to land.Jan 31 2026, 9:07 PM