Re: [PATCH gwproxy v9 2/2] gwproxy: refactor code base to add experimental raw DNS backend

[Alviro Iskandar Setiawan <alviro.iskandar@gnuweeb.org>]

On Wed, Sep 10, 2025 at 10:07 AM Ahmad Gani wrote:
> +       cfg = &w->ctx->cfg;
> +       resolv = &w->dns_resolver;
> +       p1 = realloc(resolv->stack.arr, cfg->sess_map_cap * sizeof(*resolv->stack.arr));
> +       if (!p1)
> +               return;
> +       p2 = realloc(resolv->sess_map, cfg->sess_map_cap * sizeof(*resolv->sess_map));
> +       if (!p2)
> +               return;

This is absolutely stupid. You're messing with a simple C object
without understanding even the basics regarding their handling.

Just because it's a shrink operation, it doesn't mean realloc() will
always spit out the same pointer you fed it.

If "realloc(X, new_size)" succeeds, there's no guarantee the returned
pointer matches the one you passed. 'X' could be invalid after the
realloc() call.

So, if "p2 = realloc()" fails, you could be leaking p1, and
->stack.arr might be invalid too, yet it's still used. Clearly, this
one mistake results in double bugs, use-after-free and memory leak,
because realloc() might free the pointer you gave it and allocate a
new memory area with a different address.

-- 
Software Engineer & ITPM Officer
Alviro Iskandar Setiawan
+1 908 777 0074