ptrarray: Handle realloc() failure in ptr_array_insert()

ptr_array_insert() assigned the result of realloc() directly to
pa->pdata and bumped the capacity without checking for failure, so on
out-of-memory the old buffer was leaked and the following store or
memmove() wrote through a NULL pointer.

Keep the old buffer on failure and return -1 from ptr_array_insert()
and ptr_array_add(). The callers now handle the error:

- the array lookup cache (plist.c) is dropped instead of silently going
  out of sync with the node list; lookups then fall back to walking
  the children, as they do before the cache exists
- bplist parsing (used_indexes) and serialization (objects) return
  PLIST_ERR_NO_MEM; ignoring the error in parse_bin_node_at_index()
  would otherwise loop forever since the array never grows

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 7 insertions, 2 deletions

diff --git a/src/bplist.c b/src/bplist.c
index 7b08532..ea829c7 100644
--- a/src/bplist.c
+++ b/src/bplist.c
@@ -876,7 +876,10 @@ static plist_t parse_bin_node_at_index(struct bplist_data *bplist, uint32_t node
     /* store node_index for current recursion level */
     if ((uint32_t)ptr_array_size(bplist->used_indexes) < bplist->level+1) {
         while ((uint32_t)ptr_array_size(bplist->used_indexes) < bplist->level+1) {
-            ptr_array_add(bplist->used_indexes, (void*)(uintptr_t)node_index);
+            if (ptr_array_add(bplist->used_indexes, (void*)(uintptr_t)node_index) < 0) {
+                bplist->err = PLIST_ERR_NO_MEM;
+                return NULL;
+            }
         }
     } else {
 	ptr_array_set(bplist->used_indexes, (void*)(uintptr_t)node_index, bplist->level);
@@ -1106,7 +1109,9 @@ static plist_err_t serialize_plist(node_t node, void* data, uint32_t depth)
     hash_table_insert(ser->ref_table, node, index_val);
 
     // now append current node to object array
-    ptr_array_add(ser->objects, node);
+    if (ptr_array_add(ser->objects, node) < 0) {
+        return PLIST_ERR_NO_MEM;
+    }
 
     // now recurse on children
     node_t ch;