Use of `realloc` without aliasing can lead to memory leaksCXX-W2049

Found realloc assignment to the same expression as passed to the first argument.

The return value of realloc is assigned to the same expression as passed to the first argument. The problem with this construct is that if realloc fails, it returns a null pointer but does not deallocate the original memory. If no other variable is pointing to it, the original memory block is not available anymore for the program to use or free. In either case, p = realloc(p, size) indicates a bad coding style and can be replaced by q = realloc(p, size).

The pointer expression used at realloc can be a variable or a field member of a data structure but cannot contain function calls or unresolved types. In obvious cases when the pointer used at realloc is assigned to another variable before the realloc call, no warning is emitted. This happens only if a simple expression in the form of q = p or void *q = p is found in the same function where p = realloc(p, ...) is found. The assignment has to be before the call to realloc (but otherwise at any place) in the same function. This suppression works only if p is a single variable.

Consider using a different variable for assigning the return value from realloc or consider capturing the first argument to the realloc in a separate variable before invoking realloc.

Bad Practice

struct A {
  void *p;
};

A &getA();

void foo(void *p, A *a, int new_size) {
  p = realloc(p, new_size); // warning
  a->p = realloc(a->p, new_size); // warning
}

Recommended

struct A {
  void *p;
};

A &getA();

void foo(void *p, int new_size) {
  void *p1 = p;
  p = realloc(p, new_size); // no warning
  getA().p = realloc(getA().p, new_size); // no warning
}

References

• realloc