]> git.ipfire.org Git - thirdparty/curl.git/commitdiff
rtspd: fix to check `realloc()` result
authorViktor Szakats <commit@vsz.me>
Wed, 18 Feb 2026 18:04:12 +0000 (19:04 +0100)
committerViktor Szakats <commit@vsz.me>
Thu, 19 Feb 2026 11:38:49 +0000 (12:38 +0100)
Also enable `bugprone-suspicious-realloc-usage` clang-tidy option
to verify.

Fixing:
```
tests/server/rtspd.c:328:37: error: 'req->rtp_buffer' may be set to null if 'realloc' fails,
 which may result in a leak of the original buffer
 [bugprone-suspicious-realloc-usage,-warnings-as-errors]
  328 |                   req->rtp_buffer = realloc(req->rtp_buffer,
      |                   ~~~~~~~~~~~~~~~   ^       ~~~~~~~~~~~~~~~
```

Ref: https://clang.llvm.org/extra/clang-tidy/checks/bugprone/suspicious-realloc-usage.html

Closes #20621

.clang-tidy.yml
tests/server/rtspd.c

index 751ffcef52cdedba9c274837429ec60bac3bd1bb..91a83733eb694a11d980d75a71bead949d0ab5bf 100644 (file)
@@ -12,5 +12,6 @@ Checks: >-
   -clang-analyzer-security.ArrayBound,
   -clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling,
   -clang-diagnostic-nullability-extension,
+  bugprone-suspicious-realloc-usage,
   misc-const-correctness,
   portability-*
index f9a5f7a84f74242103a68aef8000b38f289c73ee..80eb22abf22680eeba65ec841c95de501a2aeb11 100644 (file)
@@ -325,12 +325,17 @@ static int rtspd_ProcessRequest(struct rtspd_httprequest *req)
                   req->rtp_buffersize = rtp_size + 4;
                 }
                 else {
-                  req->rtp_buffer = realloc(req->rtp_buffer,
-                                            req->rtp_buffersize +
-                                            rtp_size + 4);
-                  memcpy(req->rtp_buffer + req->rtp_buffersize, rtp_scratch,
-                         rtp_size + 4);
-                  req->rtp_buffersize += rtp_size + 4;
+                  char *rtp_buffer = realloc(req->rtp_buffer,
+                                             req->rtp_buffersize +
+                                             rtp_size + 4);
+                  if(rtp_buffer) {
+                    req->rtp_buffer = rtp_buffer;
+                    memcpy(req->rtp_buffer + req->rtp_buffersize, rtp_scratch,
+                           rtp_size + 4);
+                    req->rtp_buffersize += rtp_size + 4;
+                  }
+                  else
+                    logmsg("failed resizing buffer.");
                   free(rtp_scratch);
                 }
                 logmsg("rtp_buffersize is %zu, rtp_size is %d.",