In case there are no event handlers registered with the handle, get_all_event_callbacks will count 0 elements, trying to malloc a buffer of that size. POSIX says that this can result in either a null pointer, or an unusable pointer. Since we assume a null pointer means failure, then always add a null element at the end, so we do not rely on implementation-defined behaviour of malloc. The output parameter 'len_rtn' already keeps the number of valid items in the returned array, so there are no behaviour changes for callers of get_all_event_callbacks. --- java/handle.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/java/handle.c b/java/handle.c index f225361..beb8bdc 100644 --- a/java/handle.c +++ b/java/handle.c @@ -275,7 +275,7 @@ get_all_event_callbacks (JNIEnv *env, guestfs_h *g, size_t *len_rtn) } /* Copy them into the return array. */ - r = malloc (sizeof (struct callback_data *) * (*len_rtn)); + r = malloc (sizeof (struct callback_data *) * (*len_rtn + 1)); if (r == NULL) { throw_out_of_memory (env, "malloc"); return NULL; @@ -290,6 +290,7 @@ get_all_event_callbacks (JNIEnv *env, guestfs_h *g, size_t *len_rtn) } data = guestfs_next_private (g, &key); } + r[i] = NULL; return r; } -- 2.9.3