3 files changed, 25 insertions, 13 deletions

diff --git a/gc.c b/gc.c
index 1d7ad561f4..bd52966bf1 100644
--- a/gc.c
+++ b/gc.c
@@ -8141,9 +8141,17 @@ void *
 rb_alloc_tmp_buffer_with_count(volatile VALUE *store, size_t size, size_t cnt)
 {
     void *ptr;
+    VALUE imemo;
+    rb_imemo_tmpbuf_t *tmpbuf;
 
+    /* Keep the order; allocate an empty imemo first then xmalloc, to
+     * get rid of potential memory leak */
+    imemo = rb_imemo_tmpbuf_auto_free_maybe_mark_buffer(NULL, 0);
+    *store = imemo;
     ptr = ruby_xmalloc0(size);
-    *store = rb_imemo_tmpbuf_auto_free_maybe_mark_buffer(ptr, cnt);
+    tmpbuf = (rb_imemo_tmpbuf_t *)imemo;
+    tmpbuf->ptr = ptr;
+    tmpbuf->cnt = cnt;
     return ptr;
 }
 
diff --git a/parse.y b/parse.y
index fa9348d646..f134e15270 100644
--- a/parse.y
+++ b/parse.y
@@ -10968,24 +10968,30 @@ rb_parser_set_yydebug(VALUE self, VALUE flag)
 #ifndef RIPPER
 #ifdef YYMALLOC
 #define HEAPCNT(n, size) ((n) * (size) / sizeof(YYSTYPE))
-#define ADD2HEAP(new, cnt, ptr) (p->heap = (new), (new)->cnt = (cnt), (ptr))
+/* Keep the order; NEWHEAP then xmalloc and ADD2HEAP to get rid of
+ * potential memory leak */
+#define NEWHEAP() rb_imemo_tmpbuf_parser_heap(0, p->heap, 0)
+#define ADD2HEAP(new, cnt, ptr) ((p->heap = (new))->ptr = (ptr), \
+			   (new)->cnt = (cnt), (ptr))
 
 void *
 rb_parser_malloc(struct parser_params *p, size_t size)
 {
     size_t cnt = HEAPCNT(1, size);
+    rb_imemo_tmpbuf_t *n = NEWHEAP();
     void *ptr = xmalloc(size);
-    p->heap = rb_imemo_tmpbuf_parser_heap(ptr, p->heap, cnt);
-    return p->heap->ptr;
+
+    return ADD2HEAP(n, cnt, ptr);
 }
 
 void *
 rb_parser_calloc(struct parser_params *p, size_t nelem, size_t size)
 {
     size_t cnt = HEAPCNT(nelem, size);
+    rb_imemo_tmpbuf_t *n = NEWHEAP();
     void *ptr = xcalloc(nelem, size);
-    p->heap = rb_imemo_tmpbuf_parser_heap(ptr, p->heap, cnt);
-    return p->heap->ptr;
+
+    return ADD2HEAP(n, cnt, ptr);
 }
 
 void *
@@ -11003,9 +11009,9 @@ rb_parser_realloc(struct parser_params *p, void *ptr, size_t size)
 	    }
 	} while ((n = n->next) != NULL);
     }
+    n = NEWHEAP();
     ptr = xrealloc(ptr, size);
-    p->heap = rb_imemo_tmpbuf_parser_heap(ptr, p->heap, cnt);
-    return p->heap->ptr;
+    return ADD2HEAP(n, cnt, ptr);
 }
 
 void
diff --git a/process.c b/process.c
index 5601d82cdc..c1c8432a45 100644
--- a/process.c
+++ b/process.c
@@ -2358,11 +2358,9 @@ open_func(void *ptr)
 static void
 rb_execarg_allocate_dup2_tmpbuf(struct rb_execarg *eargp, long len)
 {
-    eargp->dup2_tmpbuf =
-        rb_imemo_tmpbuf_auto_free_pointer(
-            ruby_xmalloc(
-                run_exec_dup2_tmpbuf_size(
-                    len)));
+    VALUE tmpbuf = rb_imemo_tmpbuf_auto_free_pointer(NULL);
+    ((rb_imemo_tmpbuf_t *)tmpbuf)->ptr = ruby_xmalloc(run_exec_dup2_tmpbuf_size(len));
+    eargp->dup2_tmpbuf = tmpbuf;
 }
 
 static VALUE