From 8b48fa72d359de89215f50cbf6ac8c77ae5de9b4 Mon Sep 17 00:00:00 2001 From: Comtea04 Date: Sun, 27 Sep 2026 15:06:22 +0900 Subject: ptrarray: Handle realloc() failure in ptr_array_insert() ptr_array_insert() assigned the result of realloc() directly to pa->pdata and bumped the capacity without checking for failure, so on out-of-memory the old buffer was leaked and the following store or memmove() wrote through a NULL pointer. Keep the old buffer on failure and return -1 from ptr_array_insert() and ptr_array_add(). The callers now handle the error: - the array lookup cache (plist.c) is dropped instead of silently going out of sync with the node list; lookups then fall back to walking the children, as they do before the cache exists - bplist parsing (used_indexes) and serialization (objects) return PLIST_ERR_NO_MEM; ignoring the error in parse_bin_node_at_index() would otherwise loop forever since the array never grows Co-Authored-By: Claude Opus 5.5 --- src/ptrarray.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) (limited to 'src/ptrarray.c') diff --git a/src/ptrarray.c b/src/ptrarray.c index 3a11031..bdcd428 100644 --- a/src/ptrarray.c +++ b/src/ptrarray.c @@ -40,12 +40,16 @@ void ptr_array_free(ptrarray_t *pa) free(pa); } -void ptr_array_insert(ptrarray_t *pa, void *data, long array_index) +int ptr_array_insert(ptrarray_t *pa, void *data, long array_index) { - if (!pa || !pa->pdata) return; + if (!pa || !pa->pdata) return -1; long remaining = pa->capacity-pa->len; if (remaining == 0) { - pa->pdata = (void**)realloc(pa->pdata, sizeof(void*) * (pa->capacity + pa->capacity_step)); + void **newdata = (void**)realloc(pa->pdata, sizeof(void*) * (pa->capacity + pa->capacity_step)); + if (!newdata) { + return -1; + } + pa->pdata = newdata; pa->capacity += pa->capacity_step; } if (array_index < 0 || array_index >= pa->len) { @@ -55,11 +59,12 @@ void ptr_array_insert(ptrarray_t *pa, void *data, long array_index) pa->pdata[array_index] = data; } pa->len++; + return 0; } -void ptr_array_add(ptrarray_t *pa, void *data) +int ptr_array_add(ptrarray_t *pa, void *data) { - ptr_array_insert(pa, data, -1); + return ptr_array_insert(pa, data, -1); } void ptr_array_remove(ptrarray_t *pa, long array_index) -- cgit v1.1-32-gdbae