[PATCH] expr: plug a memory leak in eval6()

[Kamil Dudka]

* src/expr.c (eval6): Free memory allocated by mbs_logical_substr().

Introduced in v8.27-47-ga9f2be5.  Detected by Coverity Analysis:

Error: RESOURCE_LEAK:
src/expr.c:849: alloc_fn: Storage is returned from allocation function 
"mbs_logical_substr".
src/expr.c:275:5: alloc_fn: Storage is returned from allocation function 
"xstrdup".
lib/xmalloc.c:121:3: alloc_fn: Storage is returned from allocation function 
"xmemdup".
lib/xmalloc.c:113:3: alloc_fn: Storage is returned from allocation function 
"xmalloc".
lib/xmalloc.c:41:11: alloc_fn: Storage is returned from allocation function 
"malloc".
lib/xmalloc.c:41:11: var_assign: Assigning: "p" = "malloc(n)".
lib/xmalloc.c:44:3: return_alloc: Returning allocated memory "p".
lib/xmalloc.c:113:3: identity_transfer: Passing "xmalloc(s)" as argument 1 to 
function "memcpy", which returns that argument. [Note: The source code 
implementation of the function has been overridden by a builtin model.]
lib/xmalloc.c:113:3: return_alloc_fn: Directly returning storage allocated by 
"memcpy".
lib/xmalloc.c:121:3: return_alloc_fn: Directly returning storage allocated by 
"xmemdup".
src/expr.c:275:5: return_alloc_fn: Directly returning storage allocated by 
"xstrdup".
src/expr.c:849: var_assign: Assigning: "s" = storage returned from 
"mbs_logical_substr(l->u.s, pos, len)".
src/expr.c:850: noescape: Resource "s" is not freed or pointed-to in 
"str_value".
src/expr.c:488:24: noescape: "str_value(char const *)" does not free or save 
its parameter "s".
src/expr.c:851: leaked_storage: Variable "s" going out of scope leaks the 
storage it points to.
849|             char *s = mbs_logical_substr (l->u.s, pos, len);
850|             v = str_value (s);
851|->         }
852|         freev (l);
853|         freev (i1);
---
 src/expr.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/expr.c b/src/expr.c
index 795140c..0f6f87a 100644
--- a/src/expr.c
+++ b/src/expr.c
@@ -848,6 +848,7 @@ eval6 (bool evaluate)
 
           char *s = mbs_logical_substr (l->u.s, pos, len);
           v = str_value (s);
+          free(s);
         }
       freev (l);
       freev (i1);
-- 
2.9.5