title: Is it safe to have asprintf use a non-NULL target pointer that is also a input?
body: <p><strong>tl;dr</strong> Can <code>asprintf</code> be used naively for concatenation without invoking a temporary pointer?</p>
  
  <hr>
  
  <p>The function <code>asprintf</code> introduced by GNU and adopted in several other clib implementations is a tempting solution for arbitrary concatenation in c using a scheme like</p>
  
  <pre><code>int i=0;
  char *str = strdup(argv[i]);
  while (argv[++i]) {
     asprintf(&amp;str,"%s %s",argv[i],str);   // &lt;=== This line
  }
  asprintf(&amp;str,"%s\n",str);
  </code></pre>
  
  <p>When wrapped in a main and the necessary includes, this runs fine for me. </p>
  
  <h2>But...</h2>
  
  <p>Is it leaking memory all over the place? Valgrind says it is on my box. Is this a bug?</p>
  
  <p>The man-page that I have in front of me says</p>
  
  <blockquote>
    <p>The asprintf() and vasprintf() functions set *ret to be a pointer to a
         buffer sufficiently large to hold the formatted string.  This pointer
         should be passed to free(3) to release the allocated storage when it is
         no longer needed.  If sufficient space cannot be allocated, asprintf()
         and vasprintf() will return -1 and set ret to be a NULL pointer.</p>
  </blockquote>
  
  <p>In the absense of the the phrase <em>"set <code>*ret</code> to be a pointer to a <strong>new</strong> buffer [...]"</em>, I am tempted to assume that the function is using <code>realloc</code> as <code>getline</code> does.</p>
  
  <h2>What might be a problem?</h2>
  
  <p>Using the signature <code>int asprintf(char **ret, const char *format, ...);</code> for concreteness.</p>
  
  <ol>
  <li><p><code>asprintf</code> runs <code>realloc</code> too soon. </p>
  
  <p>Imagine that we implement the function in such a away that we could run <code>realloc(*ret)</code> before it dereferences one of the varargs that aliased the original buffer. That buffer has been freed and this is technically undefined behavior. This would represent a bug.</p></li>
  <li><p><code>asprintf</code> writes into the buffer before it reading it. In the above code we can imaging the function copying the contents of <code>argv[1]</code> into <code>*ret</code> before it every <code>va_arg</code> on the <code>str</code> argument. The manpage I quote does not seem to rule this case out.</p></li>
  <li><p><code>asprintf</code> does not <code>free *ret</code> either directly or through the use of <code>realloc</code>. This would avoid problem number (1) but would leak memory if used as above. Again that man page seems not to rule it out.</p></li>
  </ol>
  
  <h2>Work around</h2>
  
  <p>All of the above could be avoided by replacing the single call to <code>asprintf</code> with</p>
  
  <pre><code>{
    char *newStr = NULL;
    asprintf(newStr,"%s %s",argv[i],str);
    free(str);
    str = newStr;
  }
  </code></pre>
  
  <p>but that is pretty clunky.</p>
  
  <p><strong>Does the consensus implementation guarantee that the first code sample is safe and correct?</strong></p>