Bug#264884: globfree() double-frees

[GOTO Masanori <gotom@debian.or.jp>]

Hi,

At Tue, 10 Aug 2004 14:33:42 -0500,
Jeff Licquia wrote:
> Certain kinds of problems in glob() result in a GLOB_ABORTED return
> value.  In these circumstances, the glob_t passed in is likely to
> contain partial results (per POSIX), and thus, globfree() needs to be
> called to prevent a memory leak.

What's the essential point of /tset/LSB.os/genuts/glob/T.glob 30 ?

> Unfortunately, glob() itself calls globfree() under certain
> circumstances.  Calling globfree() again (which is legal and in fact
> mandated under POSIX) causes certain portions of the structure to be
> double-freed.  Under many circumstances, this results in infinite loops
> or SIGSEGV during the next malloc.

Which documentation (and line number) is "mandated under POSIX"
described?

Regards,
-- gotom