From 8be6c7056d18cd5aa5edddfc73bfd4206b038cee Mon Sep 17 00:00:00 2001
From: "Richard W.M. Jones" <rjones@redhat.com>
Date: Thu, 23 Apr 2009 19:33:00 +0100
Subject: [PATCH] catsprintf leaks, use open_memstream instead.

---
 daemon/daemon.h |  8 --------
 daemon/debug.c  | 26 ++++++++++++++++----------
 2 files changed, 16 insertions(+), 18 deletions(-)

diff --git a/daemon/daemon.h b/daemon/daemon.h
index 331fc0d..3f51056 100644
--- a/daemon/daemon.h
+++ b/daemon/daemon.h
@@ -92,14 +92,6 @@ extern void send_file_end (int cancel);
 /* only call this if there is a FileOut parameter */
 extern void reply (xdrproc_t xdrp, char *ret);
 
-/* Append to existing string.  If existing string is NULL then
- * this creates a new string.  This uses an "interesting" variation
- * of asprintf.
- */
-
-#define catprintf(strp,fs,...) \
-  asprintf ((strp), "%s" fs, *(strp) ? *(strp) : "", __VA_ARGS__)
-
 /* Helper for functions that need a root filesystem mounted.
  * NB. Cannot be used for FileIn functions.
  */
diff --git a/daemon/debug.c b/daemon/debug.c
index fc10531..e4a7f05 100644
--- a/daemon/debug.c
+++ b/daemon/debug.c
@@ -114,15 +114,24 @@ static char *
 debug_fds (const char *subcmd, int argc, char *const *const argv)
 {
   int r;
-  char *out = NULL;
+  char *out;
+  size_t size;
+  FILE *fp;
   DIR *dir;
   struct dirent *d;
   char fname[256], link[256];
   struct stat statbuf;
 
+  fp = open_memstream (&out, &size);
+  if (!fp) {
+    reply_with_perror ("open_memstream");
+    return NULL;
+  }
+
   dir = opendir ("/proc/self/fd");
   if (!dir) {
     reply_with_perror ("opendir: /proc/self/fd");
+    fclose (fp);
     return NULL;
   }
 
@@ -135,6 +144,7 @@ debug_fds (const char *subcmd, int argc, char *const *const argv)
     r = lstat (fname, &statbuf);
     if (r == -1) {
       reply_with_perror ("stat: %s", fname);
+      fclose (fp);
       free (out);
       closedir (dir);
       return NULL;
@@ -144,24 +154,20 @@ debug_fds (const char *subcmd, int argc, char *const *const argv)
       r = readlink (fname, link, sizeof link - 1);
       if (r == -1) {
 	reply_with_perror ("readline: %s", fname);
+	fclose (fp);
 	free (out);
 	closedir (dir);
 	return NULL;
       }
       link[r] = '\0';
 
-      r = catprintf (&out, "%2s %s\n", d->d_name, link);
+      fprintf (fp, "%2s %s\n", d->d_name, link);
     } else
-      r = catprintf (&out, "%2s 0%o\n", d->d_name, statbuf.st_mode);
-
-    if (r == -1) {
-      reply_with_perror ("catprintf");
-      free (out);
-      closedir (dir);
-      return NULL;
-    }
+      fprintf (fp, "%2s 0%o\n", d->d_name, statbuf.st_mode);
   }
 
+  fclose (fp);
+
   if (closedir (dir) == -1) {
     reply_with_perror ("closedir");
     free (out);
-- 
1.8.3.1