ptrarray: Handle realloc() failure in ptr_array_insert()

ptr_array_insert() assigned the result of realloc() directly to
pa->pdata and bumped the capacity without checking for failure, so on
out-of-memory the old buffer was leaked and the following store or
memmove() wrote through a NULL pointer.

Keep the old buffer on failure and return -1 from ptr_array_insert()
and ptr_array_add(). The callers now handle the error:

- the array lookup cache (plist.c) is dropped instead of silently going
  out of sync with the node list; lookups then fall back to walking
  the children, as they do before the cache exists
- bplist parsing (used_indexes) and serialization (objects) return
  PLIST_ERR_NO_MEM; ignoring the error in parse_bin_node_at_index()
  would otherwise loop forever since the array never grows

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 10 insertions, 5 deletions

diff --git a/src/ptrarray.c b/src/ptrarray.c
index 3a11031..bdcd428 100644
--- a/src/ptrarray.c
+++ b/src/ptrarray.c
@@ -40,12 +40,16 @@ void ptr_array_free(ptrarray_t *pa)
 	free(pa);
 }
 
-void ptr_array_insert(ptrarray_t *pa, void *data, long array_index)
+int ptr_array_insert(ptrarray_t *pa, void *data, long array_index)
 {
-	if (!pa || !pa->pdata) return;
+	if (!pa || !pa->pdata) return -1;
 	long remaining = pa->capacity-pa->len;
 	if (remaining == 0) {
-		pa->pdata = (void**)realloc(pa->pdata, sizeof(void*) * (pa->capacity + pa->capacity_step));
+		void **newdata = (void**)realloc(pa->pdata, sizeof(void*) * (pa->capacity + pa->capacity_step));
+		if (!newdata) {
+			return -1;
+		}
+		pa->pdata = newdata;
 		pa->capacity += pa->capacity_step;
 	}
 	if (array_index < 0 || array_index >= pa->len) {
@@ -55,11 +59,12 @@ void ptr_array_insert(ptrarray_t *pa, void *data, long array_index)
 		pa->pdata[array_index] = data;
 	}
 	pa->len++;
+	return 0;
 }
 
-void ptr_array_add(ptrarray_t *pa, void *data)
+int ptr_array_add(ptrarray_t *pa, void *data)
 {
-	ptr_array_insert(pa, data, -1);
+	return ptr_array_insert(pa, data, -1);
 }
 
 void ptr_array_remove(ptrarray_t *pa, long array_index)