plist: fix use-after-free in plist_copy_node() on stack realloc

plist_copy_node() kept a pointer `f` to the top frame of its traversal
stack and dereferenced it after the stack was grown with realloc(),
which may move the buffer. Plists nested deeper than 64 levels hit this
path, causing a heap-use-after-free when reading f->depth.

Read the child depth before the realloc and use it when building the
new frame.

Thanks to @sdnuhfiu for reporting!

Fixes #328

0 files changed, 0 insertions, 0 deletions