toxcore
toxcore copied to clipboard
possibly realloc 0 size and cause uaf
I think it may cause a potential bug in list.c if bs_list_trim is called and list->n is 0. Because in such condition, when resize being called,
p = realloc(list->ids, sizeof(int) * new_size); acts like free function but list->data still points to the freed memory. It may cause use-after-free.
Although bs_list_trim hasn't been called now, I think it is a potential issue and we could add some check to make the code safer. Thanks.
If list->n == 0, then list->data will never be accessed.