When propagating dependencies from parents after parsing, an expression
node is allocated if the parent symbol is a 'choice'. This node was
never freed.

Outline of leak:

        if (sym && sym_is_choice(sym)) {
                ...
                *Allocate (in this case only)*
                parentdep = expr_alloc_symbol(sym);
        } else if (parent->prompt)
                parentdep = parent->prompt->visible.expr;
        else
                parentdep = parent->dep;

        for (menu = parent->list; menu; menu = menu->next) {
                ...
                *Copy*
                basedep = expr_alloc_and(expr_copy(parentdep), basedep);
                ...
        }
        *parentdep lost if the parent is a choice!*

Fix by freeing 'parentdep' after the loop if the parent symbol is a
choice. Note that this only frees the expression node and not the choice
symbol itself.

Summary from Valgrind on 'menuconfig' (ARCH=x86) before the fix:

        LEAK SUMMARY:
           definitely lost: 1,608 bytes in 67 blocks
           ...

Summary after the fix:

        LEAK SUMMARY:
           definitely lost: 0 bytes in 0 blocks
           ...

Signed-off-by: Ulf Magnusson <ulfali...@gmail.com>
---
 scripts/kconfig/menu.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/scripts/kconfig/menu.c b/scripts/kconfig/menu.c
index 749c2bd..e0badd9 100644
--- a/scripts/kconfig/menu.c
+++ b/scripts/kconfig/menu.c
@@ -344,6 +344,10 @@ void menu_finalize(struct menu *parent)
                                }
                        }
                }
+
+               if (sym && sym_is_choice(sym))
+                       expr_free(parentdep);
+
                for (menu = parent->list; menu; menu = menu->next)
                        menu_finalize(menu);
        } else if (sym) {
-- 
2.7.4

Reply via email to