hzy eaf7baf1b6 util: check UTIL_realloc result before computing *bufEnd in UTIL_prepareFileList ...

In both the _WIN32 and the POSIX variant of UTIL_prepareFileList(),
the buffer-growth branch computed

    *bufEnd = *bufStart + newListSize;

before checking whether UTIL_realloc() succeeded. UTIL_realloc frees
the old block and returns NULL on failure, so the statement performs
pointer arithmetic on a null pointer (undefined behavior, C17 6.5.6)
and leaves *bufEnd holding a bogus non-NULL extent.

Found via cppcheck nullPointerArithmeticRedundantCheck warnings
(util.h:411 and util.h:468); confirmed end-to-end by building the real
lz4 CLI with clang -fsanitize=pointer-overflow and failing the growth
realloc via LD_PRELOAD: 'util.h:468:37: runtime error: applying
non-zero offset 16384 to null pointer'. With this patch the same run
completes with no sanitizer report.

2026-10-17 15:02:25 -07:00

18 KiB

Raw Permalink Blame History

View Raw