mem leak, short malloc; netbsd pr#3000, minoura@kw.netlaputa.or.jp

diff --git a/sys/miscfs/union/union_subr.c b/sys/miscfs/union/union_subr.c
index 9a5827b..408de99 100644 (file)
--- a/sys/miscfs/union/union_subr.c
+++ b/sys/miscfs/union/union_subr.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: union_subr.c,v 1.2 1996/02/27 08:09:00 niklas Exp $   */
+/*     $OpenBSD: union_subr.c,v 1.3 1996/12/07 13:00:16 deraadt Exp $  */
 /*     $NetBSD: union_subr.c,v 1.18 1996/02/09 22:41:10 christos Exp $ */
 
 /*
@@ -742,6 +742,10 @@ union_relookup(um, dvp, vpp, cnp, cn, path, pathlen)
        error = relookup(dvp, vpp, cn);
        if (!error)
                vrele(dvp);
+       else {
+               free(cn->cn_pnbuf, M_NAMEI);
+               cn->cn_pnbuf = 0;
+       }
 
        return (error);
 }
@@ -884,7 +888,7 @@ union_vn_create(vpp, un, p)
         * copied in the first place).
         */
        cn.cn_namelen = strlen(un->un_path);
-       cn.cn_pnbuf = (caddr_t) malloc(cn.cn_namelen, M_NAMEI, M_WAITOK);
+       cn.cn_pnbuf = (caddr_t) malloc(cn.cn_namelen+1, M_NAMEI, M_WAITOK);
        bcopy(un->un_path, cn.cn_pnbuf, cn.cn_namelen+1);
        cn.cn_nameiop = CREATE;
        cn.cn_flags = (LOCKPARENT|HASBUF|SAVENAME|SAVESTART|ISLASTCN);