--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2007-04-23  Bruno Haible  <bruno@clisp.org>
+
+	* lib/fpurge.c (fpurge) [glibc, BSD]: Free a malloc()ed ungetc buffer.
+	Reported by Eric Blake.
+
 2007-04-23  Bruno Haible  <bruno@clisp.org>
 
 	* lib/fbufmode.c (fbufmode): Port to Solaris/SPARC64.

--- a/lib/fpurge.c
+++ b/lib/fpurge.c
@@ -29,6 +29,12 @@
 #if defined _IO_ferror_unlocked     /* GNU libc, BeOS */
   fp->_IO_read_end = fp->_IO_read_ptr;
   fp->_IO_write_ptr = fp->_IO_write_base;
+  /* Avoid memory leak when there is an active ungetc buffer.  */
+  if (fp->_IO_save_base != NULL)
+    {
+      free (fp->_IO_save_base);
+      fp->_IO_save_base = NULL;
+    }
   return 0;
 #elif defined __sferror             /* FreeBSD, NetBSD, OpenBSD, MacOS X, Cygwin */
   fp->_p = fp->_bf._base;
@@ -36,6 +42,20 @@
   fp->_w = ((fp->_flags & (__SLBF | __SNBF)) == 0 /* fully buffered? */
 	    ? fp->_bf._size
 	    : 0);
+  /* Avoid memory leak when there is an active ungetc buffer.  */
+# if defined __NetBSD__ || defined __OpenBSD__ /* NetBSD, OpenBSD */
+   /* See <http://cvsweb.netbsd.org/bsdweb.cgi/src/lib/libc/stdio/fileext.h?rev=HEAD&content-type=text/x-cvsweb-markup>
+      and <http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/stdio/fileext.h?rev=HEAD&content-type=text/x-cvsweb-markup> */
+#  define fp_ub ((struct { struct __sbuf _ub; } *) fp->_ext._base)->_ub
+# else                                         /* FreeBSD, MacOS X, Cygwin */
+#  define fp_ub fp->_ub
+# endif
+  if (fp_ub._base != NULL)
+    {
+      if (fp_ub._base != fp->_ubuf)
+	free (fp_ub._base);
+      fp_ub._base = NULL;
+    }
   return 0;
 #elif defined _IOERR                /* AIX, HP-UX, IRIX, OSF/1, Solaris, mingw */
   fp->_ptr = fp->_base;
@@ -43,6 +63,6 @@
     fp->_cnt = 0;
   return 0;
 #else
- #error "Please port gnulib fpurge.c to your platform!"
+ #error "Please port gnulib fpurge.c to your platform! Look at the definitions of fflush, setvbuf and ungetc on your system, then report this to bug-gnulib."
 #endif
 }