From 8b48fa72d359de89215f50cbf6ac8c77ae5de9b4 Mon Sep 17 00:00:00 2001 From: Comtea04 Date: Sun, 27 Sep 2026 15:06:22 +0900 Subject: ptrarray: Handle realloc() failure in ptr_array_insert() ptr_array_insert() assigned the result of realloc() directly to pa->pdata and bumped the capacity without checking for failure, so on out-of-memory the old buffer was leaked and the following store or memmove() wrote through a NULL pointer. Keep the old buffer on failure and return -1 from ptr_array_insert() and ptr_array_add(). The callers now handle the error: - the array lookup cache (plist.c) is dropped instead of silently going out of sync with the node list; lookups then fall back to walking the children, as they do before the cache exists - bplist parsing (used_indexes) and serialization (objects) return PLIST_ERR_NO_MEM; ignoring the error in parse_bin_node_at_index() would otherwise loop forever since the array never grows Co-Authored-By: Claude Opus 5.5 --- src/bplist.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) (limited to 'src/bplist.c') diff --git a/src/bplist.c b/src/bplist.c index 7b08532..ea829c7 100644 --- a/src/bplist.c +++ b/src/bplist.c @@ -876,7 +876,10 @@ static plist_t parse_bin_node_at_index(struct bplist_data *bplist, uint32_t node /* store node_index for current recursion level */ if ((uint32_t)ptr_array_size(bplist->used_indexes) < bplist->level+1) { while ((uint32_t)ptr_array_size(bplist->used_indexes) < bplist->level+1) { - ptr_array_add(bplist->used_indexes, (void*)(uintptr_t)node_index); + if (ptr_array_add(bplist->used_indexes, (void*)(uintptr_t)node_index) < 0) { + bplist->err = PLIST_ERR_NO_MEM; + return NULL; + } } } else { ptr_array_set(bplist->used_indexes, (void*)(uintptr_t)node_index, bplist->level); @@ -1106,7 +1109,9 @@ static plist_err_t serialize_plist(node_t node, void* data, uint32_t depth) hash_table_insert(ser->ref_table, node, index_val); // now append current node to object array - ptr_array_add(ser->objects, node); + if (ptr_array_add(ser->objects, node) < 0) { + return PLIST_ERR_NO_MEM; + } // now recurse on children node_t ch; -- cgit v1.1-32-gdbae