At line 589 of coreutils/lib/locale_charset.c, var ‘aliases' points to a buffer which is allocated using malloc() .This buffer is not freed when codeset is still an empty string after the loop (Line 589~597). So it will be leaked under such situation. Our static analysis tool reports this problem. 588 /* Resolve alias. */ 589 for (aliases = get_charset_aliases (); 590 *aliases != '\0'; 591 aliases += strlen (aliases) + 1, aliases += strlen (aliases) + 1) 592 if (strcmp (codeset, aliases) == 0 593 || (aliases[0] == '*' && aliases[1] == '\0')) 594 { 595 codeset = aliases + strlen (aliases) + 1; 596 break; 597 } 598 599 /* Don't return an empty string. GNU libc and GNU libiconv interpret 600 the empty string as denoting "the locale's character encoding", 601 thus GNU libiconv would call this function a second time. */ 602 if (codeset[0] == '\0') 603 codeset = "ASCII”; 604 605 #ifdef DARWIN7 606 /* Mac OS X sets MB_CUR_MAX to 1 when LC_ALL=C, and "UTF-8" 607 (the default codeset) does not work when MB_CUR_MAX is 1. */ 608 if (strcmp (codeset, "UTF-8") == 0 && MB_CUR_MAX_L (uselocale (NULL)) <= 1) 609 codeset = "ASCII"; 610 #endif 611 612 return codeset; 613 }