Version-Release number of selected component (if applicable):

glibc-2.5-107.el5_9.4

Description of problem:

newmem != NULL check is needed before accessing newmem->next.
(Described in the comment below.)

--- old/intl/dcigettext.c
+++ new/intl/dcigettext.c
@@ -1155,50 +1155,51 @@ _nl_find_msg (domain_file, domainbinding
                resize_freemem:
                  /* We must allocate a new buffer or resize the old one.  */
                  if (malloc_count > 0)
                    {
                      ++malloc_count;
                      freemem_size = malloc_count * INITIAL_BLOCK_SIZE;
                      newmem = (transmem_block_t *) realloc (transmem_list,
                                                             freemem_size);
 # ifdef _LIBC
                      if (newmem != NULL)
-                       transmem_list = transmem_list->next;
+                       transmem_list = newmem;
                      else
                        {
                          struct transmem_list *old = transmem_list;

                          transmem_list = transmem_list->next;
                          free (old);
                        }
 # endif
                    }
                  else
                    {
                      malloc_count = 1;
                      freemem_size = INITIAL_BLOCK_SIZE;
                      newmem = (transmem_block_t *) malloc (freemem_size);
+# ifdef _LIBC
+                     /* Add the block to the list of blocks we have to free
+                        at some point.  */
+                     newmem->next = transmem_list; /***** Need newmem!=NULL check first.*****/
+                     transmem_list = newmem;
+# endif
                    }
                  if (__builtin_expect (newmem == NULL, 0))
                    {
                      freemem = NULL;
                      freemem_size = 0;
                      __libc_lock_unlock (lock);
                      return (char *) -1;
                    }

 # ifdef _LIBC
-                 /* Add the block to the list of blocks we have to free
-                    at some point.  */
-                 newmem->next = transmem_list;
-                 transmem_list = newmem;
-
                  freemem = (unsigned char *) newmem->data;
                  freemem_size -= offsetof (struct transmem_list, data);
 # else
                  transmem_list = newmem;
                  freemem = newmem;
 # endif

                  outbuf = freemem + sizeof (size_t);
                }