Fix leaks and crashes on allocation failure

Found by failing each allocation in turn under ASan/UBSan/LSan:

- plist_free() leaked the whole tree if its work stack could not be
  allocated; free the children iteratively without extra memory
- plist_copy(): when a shallow copy of a dict/array failed, the original's
  lookup table was freed along with the copy's data (use-after-free)
- bplist parser: fix a NULL dereference in parse_date_node(), check the
  node_attach() results, and don't leak on failure; plist_to_bin() no
  longer leaks on an allocation failure
- free the plist data when node creation fails (plist constructors, XML,
  JSON and binary parsers)

1 files changed, 3 insertions, 0 deletions

diff --git a/src/jplist.c b/src/jplist.c
index fe0b5cb..193d231 100644
--- a/src/jplist.c
+++ b/src/jplist.c
@@ -581,6 +581,9 @@ static plist_t parse_primitive(const char* js, jsmntok_info_t* ti, int* index)
         }
         data->type = PLIST_NULL;
         val = plist_new_node(data);
+        if (!val) {
+            plist_free_data(data);
+        }
     } else if (isdigit(str_val[0]) || (str_val[0] == '-' && str_val+1 < str_end && isdigit(str_val[1]))) {
         char* endp = (char*)str_val;
         int is_neg = (str_val[0] == '-');