[PATCH 10/41] libpipe: Fix use-after-realloc

[Sergey Bugaev]

We cannot use old_buf after we realloc it, even just for subtracting it
from another pointer. Instead, compute the offsets in advance.
---
 libpipe/pq.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/libpipe/pq.c b/libpipe/pq.c
index af380274..fff03e67 100644
--- a/libpipe/pq.c
+++ b/libpipe/pq.c
@@ -193,20 +193,21 @@ packet_extend (struct packet *packet, size_t new_len)
     /* A malloc'd packet.  */
     {
       char *new_buf;
-      char *old_buf = packet->buf;
+      ptrdiff_t start_offset = packet->buf_start - packet->buf;
+      ptrdiff_t end_offset = packet->buf_end - packet->buf;
 
       if (new_len >= PACKET_SIZE_LARGE)
        /* The old packet length is malloc'd, but we want to vm_allocate the
           new length, so we'd have to copy the old contents.  */
        return 0;
 
-      new_buf = realloc (old_buf, new_len);
+      new_buf = realloc (packet->buf, new_len);
       if (! new_buf)
        return 0;
 
       packet->buf = new_buf;
-      packet->buf_start = new_buf + (packet->buf_start  - old_buf);
-      packet->buf_end = new_buf + (packet->buf_end  - old_buf);
+      packet->buf_start = new_buf + start_offset;
+      packet->buf_end = new_buf + end_offset;
     }
 
   packet->buf_len = new_len;
-- 
2.40.1