From 269d40c0db21949cfc99615a4b705e391ceebcaa Mon Sep 17 00:00:00 2001
From: Aditya Patwardhan <aditya.patwardhan@espressif.com>
Date: Mon, 26 Jul 2021 14:37:36 +0800
Subject: [PATCH] Fix memory leak on error path in register_select

And remove dead error handling code from unregister_select.

Closes https://github.com/espressif/esp-idf/pull/7296
---
 components/esp_http_client/lib/http_auth.c   |  1 +
 components/esp_http_client/lib/http_header.c |  2 +-
 components/vfs/vfs_uart.c                    | 13 ++++++-------
 3 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/components/esp_http_client/lib/http_auth.c b/components/esp_http_client/lib/http_auth.c
index 55016403f0..7d99c8591c 100644
--- a/components/esp_http_client/lib/http_auth.c
+++ b/components/esp_http_client/lib/http_auth.c
@@ -51,6 +51,7 @@ static int md5_printf(char *md, const char *fmt, ...)
     va_start(ap, fmt);
     len = vasprintf((char **)&buf, fmt, ap);
     if (buf == NULL) {
+        va_end(ap);
         return ESP_FAIL;
     }
 
diff --git a/components/esp_http_client/lib/http_header.c b/components/esp_http_client/lib/http_header.c
index e432e91e6b..ecb32693bb 100644
--- a/components/esp_http_client/lib/http_header.c
+++ b/components/esp_http_client/lib/http_header.c
@@ -162,8 +162,8 @@ int http_header_set_format(http_header_handle_t header, const char *key, const c
     char *buf = NULL;
     va_start(argptr, format);
     len = vasprintf(&buf, format, argptr);
-    HTTP_MEM_CHECK(TAG, buf, return 0);
     va_end(argptr);
+    HTTP_MEM_CHECK(TAG, buf, return 0);
     if (buf == NULL) {
         return 0;
     }
diff --git a/components/vfs/vfs_uart.c b/components/vfs/vfs_uart.c
index f0a75903c2..840f7e9210 100644
--- a/components/vfs/vfs_uart.c
+++ b/components/vfs/vfs_uart.c
@@ -343,9 +343,11 @@ static esp_err_t register_select(uart_select_args_t *args)
     if (args) {
         portENTER_CRITICAL(&s_registered_select_lock);
         const int new_size = s_registered_select_num + 1;
-        if ((s_registered_selects = realloc(s_registered_selects, new_size * sizeof(uart_select_args_t *))) == NULL) {
+        uart_select_args_t **new_selects;
+        if ((new_selects = realloc(s_registered_selects, new_size * sizeof(uart_select_args_t *))) == NULL) {
             ret = ESP_ERR_NO_MEM;
         } else {
+            s_registered_selects = new_selects;
             s_registered_selects[s_registered_select_num] = args;
             s_registered_select_num = new_size;
             ret = ESP_OK;
@@ -369,12 +371,9 @@ static esp_err_t unregister_select(uart_select_args_t *args)
                 // last item.
                 s_registered_selects[i] = s_registered_selects[new_size];
                 s_registered_selects = realloc(s_registered_selects, new_size * sizeof(uart_select_args_t *));
-                if (s_registered_selects || new_size == 0) {
-                    s_registered_select_num = new_size;
-                    ret = ESP_OK;
-                } else {
-                    ret = ESP_ERR_NO_MEM;
-                }
+                // Shrinking a buffer with realloc is guaranteed to succeed.
+                s_registered_select_num = new_size;
+                ret = ESP_OK;
                 break;
             }
         }