In case there are no event handlers registered with the handle,
get_all_event_callbacks will count 0 elements, trying to malloc a buffer
of that size. POSIX says that this can result in either a null pointer,
or an unusable pointer. Since we assume a null pointer means failure,
then always add a null element at the end, so we do not rely on
implementation-defined behaviour of malloc.
The output parameter 'len_rtn' already keeps the number of valid items
in the returned array, so there are no behaviour changes for callers of
get_all_event_callbacks.
---
ocaml/guestfs-c.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/ocaml/guestfs-c.c b/ocaml/guestfs-c.c
index 9042752..f14eee3 100644
--- a/ocaml/guestfs-c.c
+++ b/ocaml/guestfs-c.c
@@ -311,7 +311,7 @@ get_all_event_callbacks (guestfs_h *g, size_t *len_rtn)
}
/* Copy them into the return array. */
- r = malloc (sizeof (value *) * (*len_rtn));
+ r = malloc (sizeof (value *) * (*len_rtn + 1));
if (r == NULL) caml_raise_out_of_memory ();
i = 0;
@@ -323,6 +323,7 @@ get_all_event_callbacks (guestfs_h *g, size_t *len_rtn)
}
root = guestfs_next_private (g, &key);
}
+ r[i] = NULL;
return r;
}
--
2.9.3