From 9a57ec5be0635030739dbbb69327abe2bc5ab6c6 Mon Sep 17 00:00:00 2001
From: Stathis Kamperis <beket@dragonflybsd.org>
Date: Wed, 10 Jun 2009 21:44:01 +0300
Subject: [PATCH] hdestroy(3): Don't call free(3) for each hash key.

* This is unnecessarily restrictive. If the user wants static allocation,
we should allow this. If she wants dynamic then let *her* free the memory she
malloc()'ed.

* It is in conflict with the example code in the POSIX page. The code  segfaults
if you add an hdestroy() call in the end of it.

* Programs that target other implementations may segfault in DragonFly. AFAIK
sunOS 5.10 and a recent glibc work fine, whereas {Net, Free, DragonFly}BSD all
are affected because they share the same code.
---
 lib/libc/stdlib/hcreate.3 |   22 +---------------------
 lib/libc/stdlib/hcreate.c |    1 -
 2 files changed, 1 insertions(+), 22 deletions(-)

diff --git a/lib/libc/stdlib/hcreate.3 b/lib/libc/stdlib/hcreate.3
index cfa5991..6f32d51 100644
--- a/lib/libc/stdlib/hcreate.3
+++ b/lib/libc/stdlib/hcreate.3
@@ -29,7 +29,7 @@
 .\" $FreeBSD: src/lib/libc/stdlib/hcreate.3,v 1.7 2008/07/06 17:03:37 danger Exp $
 .\" $DragonFly: src/lib/libc/stdlib/hcreate.3,v 1.5 2006/05/26 19:39:37 swildner Exp $
 .\"
-.Dd July 6, 2008
+.Dd June 10, 2009
 .Os
 .Dt HCREATE 3
 .Sh NAME
@@ -75,12 +75,6 @@ function disposes of the search table, and may be followed by another call to
 After the call to
 .Fn hdestroy ,
 the data can no longer be considered accessible.
-The
-.Fn hdestroy
-function calls
-.Xr free 3
-for each comparison key in the search table
-but not the data item associated with the key.
 .Pp
 The
 .Fn hsearch
@@ -125,20 +119,6 @@ Unsuccessful resolution is
 indicated by the return of a
 .Dv NULL
 pointer.
-.Pp
-The comparison key (passed to
-.Fn hsearch
-as
-.Fa item.key )
-must be allocated using
-.Xr malloc 3
-if
-.Fa action
-is
-.Dv ENTER
-and
-.Fn hdestroy
-is called.
 .Sh RETURN VALUES
 The
 .Fn hcreate
diff --git a/lib/libc/stdlib/hcreate.c b/lib/libc/stdlib/hcreate.c
index 2d542e8..ecbb483 100644
--- a/lib/libc/stdlib/hcreate.c
+++ b/lib/libc/stdlib/hcreate.c
@@ -136,7 +136,6 @@ hdestroy(void)
 		while (!SLIST_EMPTY(&htable[idx])) {
 			ie = SLIST_FIRST(&htable[idx]);
 			SLIST_REMOVE_HEAD(&htable[idx], link);
-			free(ie->ent.key);
 			free(ie);
 		}
 	}
-- 
1.6.0.2