In case there are no event handlers registered with the handle, get_all_event_callbacks will count 0 elements, trying to malloc a buffer of that size. POSIX says that this can result in either a null pointer, or an unusable pointer. Since we assume a null pointer means failure, then always add a null element at the end, so we do not rely on implementation-defined behaviour of malloc. The output parameter 'len_rtn' already keeps the number of valid items in the returned array, so there are no behaviour changes for callers of get_all_event_callbacks. --- ocaml/guestfs-c.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/ocaml/guestfs-c.c b/ocaml/guestfs-c.c index 9042752..f14eee3 100644 --- a/ocaml/guestfs-c.c +++ b/ocaml/guestfs-c.c @@ -311,7 +311,7 @@ get_all_event_callbacks (guestfs_h *g, size_t *len_rtn) } /* Copy them into the return array. */ - r = malloc (sizeof (value *) * (*len_rtn)); + r = malloc (sizeof (value *) * (*len_rtn + 1)); if (r == NULL) caml_raise_out_of_memory (); i = 0; @@ -323,6 +323,7 @@ get_all_event_callbacks (guestfs_h *g, size_t *len_rtn) } root = guestfs_next_private (g, &key); } + r[i] = NULL; return r; } -- 2.9.3