When buf->error is 1, we do not return buf->content in the function virBufferContentAndReset(). So we should free buf->content when vsnprintf() failed. --- src/util/buf.c | 6 ++++++ 1 files changed, 6 insertions(+), 0 deletions(-) diff --git a/src/util/buf.c b/src/util/buf.c index 7557ad1..fdb7660 100644 --- a/src/util/buf.c +++ b/src/util/buf.c @@ -241,6 +241,9 @@ virBufferVSprintf(const virBufferPtr buf, const char *format, ...) size = buf->size - buf->use; if ((count = vsnprintf(&buf->content[buf->use], size, format, argptr)) < 0) { + VIR_FREE(buf->content); + buf->size = 0; + buf->use = 0; buf->error = 1; goto err; } @@ -259,6 +262,9 @@ virBufferVSprintf(const virBufferPtr buf, const char *format, ...) size = buf->size - buf->use; if ((count = vsnprintf(&buf->content[buf->use], size, format, argptr)) < 0) { + VIR_FREE(buf->content); + buf->size = 0; + buf->use = 0; buf->error = 1; goto err; } -- 1.7.1