Open
Description
I think it may cause a potential bug in list.c if bs_list_trim
is called and list->n
is 0. Because in such condition, when resize
being called,
p = realloc(list->ids, sizeof(int) * new_size);
acts like free function but list->data
still points to the freed memory. It may cause use-after-free.
Although bs_list_trim
hasn't been called now, I think it is a potential issue and we could add some check to make the code safer. Thanks.
Metadata
Metadata
Assignees
Labels
No labels