Re: [Nmh-workers] GCC 8 pre-releases have escaped...

[Ken Hornstein]

>So if c_mn was assigned the address of something other than fmt_mnull
>that wasn't alloc'ed, then there would be a problem.  But I don't see
>in the code where that could happen. (c_mn is assigned the result of
>getm(), but that's either an alloc'ed value or NULL.)

Here's a comment from scansbr.c that I think will fill in the gap.

         *
         * Every time we find a component we care about, we set that component's
         * text buffer to the current value of tmpbuf, and then switch tmpbuf
         * to the next buffer in our pool.  We also add that component to
         * our used_buf pool.
         *
         * When we're done, we go back and zero out all of the component
         * text buffer pointers that we saved in used_buf.
         *
         * Note that this means c_text memory is NOT owned by the fmt_module
         * and it's our responsibility to free it.
         */

When I wrote that comment, nothing in the format engine would ever
call free() on component names, so it wasn't a problem. scan() isn't
expecting anyone to free those buffers that it is malloc()ing.

--Ken