From 9fd3406baec5997d386cdb4c7492117604ba0a70 Mon Sep 17 00:00:00 2001
From: Nikias Bassen
Date: Thu, 5 Nov 2026 12:02:05 +0100
Subject: Fix leaks and crashes on allocation failure

Found by failing each allocation in turn under ASan/UBSan/LSan:

- plist_free() leaked the whole tree if its work stack could not be
  allocated; free the children iteratively without extra memory
- plist_copy(): when a shallow copy of a dict/array failed, the original's
  lookup table was freed along with the copy's data (use-after-free)
- bplist parser: fix a NULL dereference in parse_date_node(), check the
  node_attach() results, and don't leak on failure; plist_to_bin() no
  longer leaks on an allocation failure
- free the plist data when node creation fails (plist constructors, XML,
  JSON and binary parsers)
---
 src/jplist.c | 3 +++
 1 file changed, 3 insertions(+)

(limited to 'src/jplist.c')

diff --git a/src/jplist.c b/src/jplist.c
index fe0b5cb..193d231 100644
--- a/src/jplist.c
+++ b/src/jplist.c
@@ -581,6 +581,9 @@ static plist_t parse_primitive(const char* js, jsmntok_info_t* ti, int* index)
         }
         data->type = PLIST_NULL;
         val = plist_new_node(data);
+        if (!val) {
+            plist_free_data(data);
+        }
     } else if (isdigit(str_val[0]) || (str_val[0] == '-' && str_val+1 < str_end && isdigit(str_val[1]))) {
         char* endp = (char*)str_val;
         int is_neg = (str_val[0] == '-');
-- 
cgit v1.1-32-gdbae