From 8b48fa72d359de89215f50cbf6ac8c77ae5de9b4 Mon Sep 17 00:00:00 2001 From: Comtea04 Date: Sun, 27 Sep 2026 15:06:22 +0900 Subject: ptrarray: Handle realloc() failure in ptr_array_insert() ptr_array_insert() assigned the result of realloc() directly to pa->pdata and bumped the capacity without checking for failure, so on out-of-memory the old buffer was leaked and the following store or memmove() wrote through a NULL pointer. Keep the old buffer on failure and return -1 from ptr_array_insert() and ptr_array_add(). The callers now handle the error: - the array lookup cache (plist.c) is dropped instead of silently going out of sync with the node list; lookups then fall back to walking the children, as they do before the cache exists - bplist parsing (used_indexes) and serialization (objects) return PLIST_ERR_NO_MEM; ignoring the error in parse_bin_node_at_index() would otherwise loop forever since the array never grows Co-Authored-By: Claude Opus 5.5 --- src/plist.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) (limited to 'src/plist.c') diff --git a/src/plist.c b/src/plist.c index 05af457..5ea6c12 100644 --- a/src/plist.c +++ b/src/plist.c @@ -898,7 +898,10 @@ static plist_t plist_copy_node(node_t root) switch (f->type) { case PLIST_ARRAY: if (f->copydata->hashtable) { - ptr_array_add((ptrarray_t*)f->copydata->hashtable, newch); + if (ptr_array_add((ptrarray_t*)f->copydata->hashtable, newch) < 0) { + ptr_array_free((ptrarray_t*)f->copydata->hashtable); + f->copydata->hashtable = NULL; + } } break; @@ -987,7 +990,11 @@ static void _plist_array_post_insert(plist_t node, plist_t item, long n) ptrarray_t *pa = (ptrarray_t*)((plist_data_t)((node_t)node)->data)->hashtable; if (pa) { /* store pointer to item in array */ - ptr_array_insert(pa, item, n); + if (ptr_array_insert(pa, item, n) < 0) { + /* lookup array would be out of sync, drop it */ + ptr_array_free(pa); + ((plist_data_t)((node_t)node)->data)->hashtable = NULL; + } return; } @@ -999,7 +1006,10 @@ static void _plist_array_post_insert(plist_t node, plist_t item, long n) pa && current; current = (plist_t)node_next_sibling((node_t)current)) { - ptr_array_add(pa, current); + if (ptr_array_add(pa, current) < 0) { + ptr_array_free(pa); + pa = NULL; + } } ((plist_data_t)((node_t)node)->data)->hashtable = pa; } -- cgit v1.1-32-gdbae