Bug#696085: eglibc: memory leak in failed clnt_create call

[Simon Richter <sjr@debian.org>]

Source: eglibc
Version: 2.11.3-4
Severity: normal

Hi,

there appears to be a memory leak in the RPC implementation: if a
connection to the portmapper fails, a NULL pointer is returned from
clnt_create to indicate failure (so the caller has no handle), but a chunk
of memory allocated inside the call is never freed:

==14600== 40 bytes in 1 blocks are still reachable in loss record 1 of 1
==14600==    at 0x4C28BED: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==14600==    by 0x4C28D6F: realloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==14600==    by 0x4F2C795: bindresvport (bindrsvprt.c:102)
==14600==    by 0x4F2DAC9: clnttcp_create (clnt_tcp.c:152)
==14600==    by 0x4F2F60A: __libc_rpc_getport (pm_getport.c:110)
==14600==    by 0x4F2DA8B: clnttcp_create (clnt_tcp.c:137)
==14600==    by 0x4F2CAB3: clnt_create (clnt_gen.c:151)
==14600==    by 0x40052C: main (in /home/geier/test)

Test program attached.

   Simon

-- System Information:
Debian Release: wheezy/sid
  APT prefers testing
  APT policy: (500, 'testing'), (500, 'stable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 3.2.0-4-amd64 (SMP w/4 CPU cores)
Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

#include <rpc/rpc.h>

int main()
{
        CLIENT *client = clnt_create("localhost", 12345, 12345, "tcp");

        if(client)
                clnt_destroy(client);
}