[glibc/siddhesh/gai-cleanup2] gaih_inet: Fix leak with AF_INET6 and AI_ALL [BZ #28852]

[glibc/siddhesh/gai-cleanup2] gaih_inet: Fix leak with AF_INET6 and AI_ALL [BZ #28852]

[Siddhesh Poyarekar]

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=38454ba670d978ee9a33fdbdab4f80bdd611907b

commit 38454ba670d978ee9a33fdbdab4f80bdd611907b
Author: Siddhesh Poyarekar <siddhesh@sourceware.org>
Date:   Mon Feb 28 20:39:02 2022 +0530

    gaih_inet: Fix leak with AF_INET6 and AI_ALL [BZ #28852]
    
    Resolves: BZ #28852
    
    Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>

Diff:
---
 sysdeps/posix/getaddrinfo.c | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/sysdeps/posix/getaddrinfo.c b/sysdeps/posix/getaddrinfo.c
index 010360986a..0173397fe1 100644
--- a/sysdeps/posix/getaddrinfo.c
+++ b/sysdeps/posix/getaddrinfo.c
@@ -243,8 +243,7 @@ convert_hostent_to_gaih_addrtuple (const struct addrinfo *req,
 				   struct hostent *h,
 				   struct gaih_addrtuple **result)
 {
-  while (*result)
-    result = &(*result)->next;
+  assert (*result == NULL);
 
   /* Count the number of addresses in h->h_addr_list.  */
   size_t count = 0;
@@ -319,14 +318,22 @@ convert_hostent_to_gaih_addrtuple (const struct addrinfo *req,
     }									      \
   else if (status == NSS_STATUS_SUCCESS)				      \
     {									      \
+      struct gaih_addrtuple *addrmem = NULL;				      \
       if (!convert_hostent_to_gaih_addrtuple (req, _family, &th, &addrmem))   \
 	{								      \
 	  __resolv_context_put (res_ctx);				      \
 	  result = -EAI_SYSTEM;						      \
 	  goto free_and_return;						      \
 	}								      \
+      if (addrmem && !gaih_lookup_result_push_alloc (&res, addrmem))	      \
+	{								      \
+	  free (addrmem);						      \
+	  result = -EAI_MEMORY;						      \
+	  goto free_and_return;						      \
+	}								      \
       *pat = addrmem;							      \
-									      \
+      while (*pat != NULL)						      \
+	pat = &((*pat)->next);						      \
       if (localcanon != NULL && canon == NULL)				      \
 	{								      \
 	  canonbuf = __strdup (localcanon);				      \
@@ -338,7 +345,7 @@ convert_hostent_to_gaih_addrtuple (const struct addrinfo *req,
 	    }								      \
 	  canon = canonbuf;						      \
 	}								      \
-      if (_family == AF_INET6 && *pat != NULL)				      \
+      if (_family == AF_INET6 && addrmem != NULL)			      \
 	got_ipv6 = true;						      \
     }									      \
  }
@@ -783,7 +790,6 @@ gaih_inet (const char *name, const struct gaih_service *service,
     return rc;
 
   bool malloc_name = false;
-  struct gaih_addrtuple *addrmem = NULL;
   char *canonbuf = NULL;
   int result = 0;
   struct gaih_lookup_result res = {0};
@@ -1228,7 +1234,6 @@ gaih_inet (const char *name, const struct gaih_service *service,
  free_and_return:
   if (malloc_name)
     free ((char *) name);
-  free (addrmem);
   free (canonbuf);
   gaih_lookup_result_free (&res);
   scratch_buffer_free (&resbuf);