From baeb7430e26f9e1c0f08b763809305f1c54763f6 Mon Sep 17 00:00:00 2001 From: Martin Vlach Date: Thu, 1 Oct 2026 01:00:05 +0200 Subject: [PATCH] Don't bump arrsize in poll_listen() until the realloc has succeeded. If whine_realloc() fails in poll_listen(), arrsize has already been doubled while pollfds keeps its old size. The next call then sees arrsize != nfds, skips the extension and writes past the end of the array (or through NULL if the very first allocation failed). poll_reset() only clears nfds, so this sticks around until restart. Only update arrsize once the reallocation has succeeded. Co-Authored-By: Claude Sonnet 5.5 --- src/poll.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/poll.c b/src/poll.c index d2d1fb9..5f0bf5a 100644 --- a/src/poll.c +++ b/src/poll.c @@ -100,13 +100,13 @@ void poll_listen(int fd, short event) { /* Array too small. Extend. */ struct pollfd *new; + nfds_t newsize = (arrsize == 0) ? 64 : arrsize * 2; - arrsize = (arrsize == 0) ? 64 : arrsize * 2; - - if (!(new = whine_realloc(pollfds, arrsize * sizeof(struct pollfd)))) + if (!(new = whine_realloc(pollfds, newsize * sizeof(struct pollfd)))) return; pollfds = new; + arrsize = newsize; } memmove(&pollfds[i+1], &pollfds[i], (nfds - i) * sizeof(struct pollfd));