core: fix bugs with calls to realloc

5 files changed, 57 insertions, 20 deletions

diff --git a/src/plugins/irc/irc-mode.c b/src/plugins/irc/irc-mode.c
index 16522d27d..009a4e5e5 100644
--- a/src/plugins/irc/irc-mode.c
+++ b/src/plugins/irc/irc-mode.c
@@ -176,7 +176,7 @@ irc_mode_channel_set (struct t_irc_server *server,
 void
 irc_mode_user_add (struct t_irc_server *server, char mode)
 {
-    char str_mode[2];
+    char str_mode[2], *nick_modes2;
 
     str_mode[0] = mode;
     str_mode[1] = '\0';
@@ -185,8 +185,18 @@ irc_mode_user_add (struct t_irc_server *server, char mode)
     {
         if (!strchr (server->nick_modes, mode))
         {
-            server->nick_modes = realloc (server->nick_modes,
-                                          strlen (server->nick_modes) + 1 + 1);
+            nick_modes2 = realloc (server->nick_modes,
+                                   strlen (server->nick_modes) + 1 + 1);
+            if (!nick_modes2)
+            {
+                if (server->nick_modes)
+                {
+                    free (server->nick_modes);
+                    server->nick_modes = NULL;
+                }
+                return;
+            }
+            server->nick_modes = nick_modes2;
             strcat (server->nick_modes, str_mode);
             weechat_bar_item_update ("input_prompt");
         }
@@ -206,7 +216,7 @@ irc_mode_user_add (struct t_irc_server *server, char mode)
 void
 irc_mode_user_remove (struct t_irc_server *server, char mode)
 {
-    char *pos;
+    char *pos, *nick_modes2;
     int new_size;
     
     if (server->nick_modes)
@@ -216,7 +226,9 @@ irc_mode_user_remove (struct t_irc_server *server, char mode)
         {
             new_size = strlen (server->nick_modes);
             memmove (pos, pos + 1, strlen (pos + 1) + 1);
-            server->nick_modes = realloc (server->nick_modes, new_size);
+            nick_modes2 = realloc (server->nick_modes, new_size);
+            if (nick_modes2)
+                server->nick_modes = nick_modes2;
             weechat_bar_item_update ("input_prompt");
         }
     }
diff --git a/src/plugins/irc/irc-notify.c b/src/plugins/irc/irc-notify.c
index 29849f580..a1d1ceb27 100644
--- a/src/plugins/irc/irc-notify.c
+++ b/src/plugins/irc/irc-notify.c
@@ -118,7 +118,7 @@ irc_notify_search (struct t_irc_server *server, const char *nick)
 void
 irc_notify_set_server_option (struct t_irc_server *server)
 {
-    char *str;
+    char *str, *str2;
     struct t_irc_notify *ptr_notify;
     int total_length, length;
     
@@ -143,7 +143,14 @@ irc_notify_set_server_option (struct t_irc_server *server)
             else
             {
                 total_length += length;
-                str = realloc (str, total_length);
+                str2 = realloc (str, total_length);
+                if (!str2)
+                {
+                    if (str)
+                        free (str);
+                    return;
+                }
+                str = str2;
             }
             if (str)
             {
@@ -754,7 +761,8 @@ irc_notify_timer_ison_cb (void *data, int remaining_calls)
                 message2 = realloc (message, total_length);
                 if (!message2)
                 {
-                    free (message);
+                    if (message)
+                        free (message);
                     message = NULL;
                     break;
                 }
diff --git a/src/plugins/irc/irc-protocol.c b/src/plugins/irc/irc-protocol.c
index 17dbd7b77..0d9dace75 100644
--- a/src/plugins/irc/irc-protocol.c
+++ b/src/plugins/irc/irc-protocol.c
@@ -1908,7 +1908,7 @@ IRC_PROTOCOL_CALLBACK(001)
 
 IRC_PROTOCOL_CALLBACK(005)
 {
-    char *pos, *pos2, *pos_start, *error;
+    char *pos, *pos2, *pos_start, *error, *isupport2;
     int length_isupport, length, nick_max_length;
     
     /*
@@ -1961,11 +1961,14 @@ IRC_PROTOCOL_CALLBACK(005)
     if (server->isupport)
     {
         length_isupport = strlen (server->isupport);
-        server->isupport = realloc (server->isupport,
-                                    length_isupport + /* existing */
-                                    1 + length + 1); /* new */
-        if (server->isupport)
+        isupport2 = realloc (server->isupport,
+                             length_isupport + /* existing */
+                             1 + length + 1); /* new */
+        if (isupport2)
+        {
+            server->isupport = isupport2;
             pos_start = server->isupport + length_isupport;
+        }
     }
     else
     {
diff --git a/src/plugins/irc/irc-redirect.c b/src/plugins/irc/irc-redirect.c
index 9ebd3aabd..bb1ecf2aa 100644
--- a/src/plugins/irc/irc-redirect.c
+++ b/src/plugins/irc/irc-redirect.c
@@ -647,6 +647,8 @@ void
 irc_redirect_message_add (struct t_irc_redirect *redirect, const char *message,
                           const char *command)
 {
+    char *output2;
+    
     /*
      * if command is not for output, then don't add message
      * (it is silently ignored)
@@ -659,9 +661,16 @@ irc_redirect_message_add (struct t_irc_redirect *redirect, const char *message,
     if (redirect->output)
     {
         redirect->output_size += strlen("\n") + strlen (message);
-        redirect->output = realloc (redirect->output, redirect->output_size);
-        if (redirect->output)
-            strcat (redirect->output, "\n");
+        output2 = realloc (redirect->output, redirect->output_size);
+        if (!output2)
+        {
+            free (redirect->output);
+            redirect->output = NULL;
+            redirect->output_size = 0;
+            return;
+        }
+        redirect->output = output2;
+        strcat (redirect->output, "\n");
     }
     else
     {
diff --git a/src/plugins/irc/irc-server.c b/src/plugins/irc/irc-server.c
index 85a45f9ad..9bab689e4 100644
--- a/src/plugins/irc/irc-server.c
+++ b/src/plugins/irc/irc-server.c
@@ -1888,23 +1888,28 @@ irc_server_msgq_add_msg (struct t_irc_server *server, const char *msg)
 void
 irc_server_msgq_add_unterminated (struct t_irc_server *server, const char *string)
 {
+    char *unterminated_message2;
+    
     if (!string[0])
         return;
     
     if (server->unterminated_message)
     {
-        server->unterminated_message =
+        unterminated_message2 =
             realloc (server->unterminated_message,
                      (strlen (server->unterminated_message) +
                       strlen (string) + 1));
-        if (!server->unterminated_message)
+        if (!unterminated_message2)
         {
             weechat_printf (server->buffer,
                             _("%s%s: not enough memory for received message"),
                             weechat_prefix ("error"), IRC_PLUGIN_NAME);
+            free (server->unterminated_message);
+            server->unterminated_message = NULL;
+            return;
         }
-        else
-            strcat (server->unterminated_message, string);
+        server->unterminated_message = unterminated_message2;
+        strcat (server->unterminated_message, string);
     }
     else
     {