From 9fd3406baec5997d386cdb4c7492117604ba0a70 Mon Sep 17 00:00:00 2001
From: Nikias Bassen
Date: Thu, 5 Nov 2026 12:02:05 +0100
Subject: Fix leaks and crashes on allocation failure

Found by failing each allocation in turn under ASan/UBSan/LSan:

- plist_free() leaked the whole tree if its work stack could not be
  allocated; free the children iteratively without extra memory
- plist_copy(): when a shallow copy of a dict/array failed, the original's
  lookup table was freed along with the copy's data (use-after-free)
- bplist parser: fix a NULL dereference in parse_date_node(), check the
  node_attach() results, and don't leak on failure; plist_to_bin() no
  longer leaks on an allocation failure
- free the plist data when node creation fails (plist constructors, XML,
  JSON and binary parsers)
---
 src/xplist.c | 1 +
 1 file changed, 1 insertion(+)

(limited to 'src/xplist.c')

diff --git a/src/xplist.c b/src/xplist.c
index 19d98ed..adf3f40 100644
--- a/src/xplist.c
+++ b/src/xplist.c
@@ -1212,6 +1212,7 @@ static plist_err_t node_from_xml(parse_ctx ctx, plist_t *plist)
             }
             subnode = plist_new_node(data);
             if (!subnode) {
+                plist_free_data(data);
                 PLIST_XML_ERR("failed to create node\n");
                 ctx->err = PLIST_ERR_NO_MEM;
                 goto err_out;
-- 
cgit v1.1-32-gdbae