Here is a simple example. Let's emulate this with the following test case code:
/* * A demo: this function allocates memory internally; the caller * is responsible for freeing it! */static void silly_getpath(char **ptr){#include <linux/limits.h> *ptr = malloc(PATH_MAX); if (!ptr) FATAL("malloc failed\n"); strcpy(*ptr, getenv("PATH")); if (!*ptr) FATAL("getenv failed\n");}/* test case 13 : memory leak test case 3: "lib" API leak */static void leakage_case3(int cond){ char *mypath=NULL; printf("\n## Leakage test: case 3: \"lib\" API" ": runtime cond = %d\n", cond); /* Use C's illusory 'pass-by-reference' model */ silly_getpath(&mypath); printf("mypath = %s\n", mypath); if (cond) /* Bug: if cond==0 then we have a leak! */ free(mypath); ...
