1 files changed, 29 insertions, 21 deletions

diff --git a/src/libical/icalarray.c b/src/libical/icalarray.c
index 58c545d2..a472c3a0 100644
--- a/src/libical/icalarray.c
+++ b/src/libical/icalarray.c
@@ -2,18 +2,10 @@
  FILE: icalarray.c
  CREATOR: Damon Chaplin 07 March 2001
 
- (C) COPYRIGHT 2001, Ximian, Inc.
+ SPDX-FileCopyrightText: 2001, Ximian, Inc.
 
- This library is free software; you can redistribute it and/or modify
- it under the terms of either:
+ SPDX-License-Identifier: LGPL-2.1-only OR MPL-2.0
 
-    The LGPL as published by the Free Software Foundation, version
-    2.1, available at: https://www.gnu.org/licenses/lgpl-2.1.html
-
- Or:
-
-    The Mozilla Public License Version 2.0. You may obtain a copy of
-    the License at https://www.mozilla.org/MPL/
 ======================================================================*/
 
 #ifdef HAVE_CONFIG_H
@@ -22,6 +14,7 @@
 
 #include "icalarray.h"
 #include "icalerror.h"
+#include "icalmemory.h"
 #include "qsort_gen.h"
 
 #include <stdlib.h>
@@ -33,7 +26,7 @@ icalarray *icalarray_new(size_t element_size, size_t increment_size)
 {
     icalarray *array;
 
-    array = (icalarray *) malloc(sizeof(icalarray));
+    array = (icalarray *) icalmemory_new_buffer(sizeof(icalarray));
     if (!array) {
         icalerror_set_errno(ICAL_NEWFAILED_ERROR);
         return NULL;
@@ -50,7 +43,7 @@ icalarray *icalarray_new(size_t element_size, size_t increment_size)
 
 static void *icalarray_alloc_chunk(icalarray *array)
 {
-    void *chunk = malloc(array->element_size * array->increment_size);
+    void *chunk = icalmemory_new_buffer(array->element_size * array->increment_size);
 
     if (!chunk) {
         icalerror_set_errno(ICAL_NEWFAILED_ERROR);
@@ -68,23 +61,30 @@ icalarray *icalarray_copy(icalarray *originalarray)
         return NULL;
     }
 
-    array->num_elements = originalarray->num_elements;
-    array->space_allocated = originalarray->space_allocated;
-
-    array->chunks = malloc(chunks * sizeof(void *));
+    array->chunks = icalmemory_new_buffer(chunks * sizeof(void *));
     if (array->chunks) {
         for (chunk = 0; chunk < chunks; chunk++) {
             array->chunks[chunk] = icalarray_alloc_chunk(array);
             if (array->chunks[chunk]) {
                 memcpy(array->chunks[chunk], originalarray->chunks[chunk],
                        array->increment_size * array->element_size);
+
+                array->space_allocated += array->increment_size;
+            } else {
+                icalerror_set_errno(ICAL_ALLOCATION_ERROR);
+                icalarray_free(array);
+                return NULL;
             }
         }
 
     } else {
         icalerror_set_errno(ICAL_ALLOCATION_ERROR);
+        icalarray_free(array);
+        return NULL;
     }
 
+    array->num_elements = originalarray->num_elements;
+
     return array;
 }
 
@@ -95,12 +95,12 @@ void icalarray_free(icalarray *array)
         size_t chunk;
 
         for (chunk = 0; chunk < chunks; chunk++) {
-            free(array->chunks[chunk]);
+            icalmemory_free_buffer(array->chunks[chunk]);
         }
-        free(array->chunks);
+        icalmemory_free_buffer(array->chunks);
         array->chunks = 0;
     }
-    free(array);
+    icalmemory_free_buffer(array);
 }
 
 void icalarray_append(icalarray *array, const void *element)
@@ -109,6 +109,10 @@ void icalarray_append(icalarray *array, const void *element)
 
     if (array->num_elements >= array->space_allocated) {
         icalarray_expand(array, 1);
+        if (array->num_elements >= array->space_allocated) {
+            /* expansion failed. Error has already been set. */
+            return;
+        }
     }
 
     pos = array->num_elements++;
@@ -180,7 +184,7 @@ static void icalarray_expand(icalarray *array, size_t space_needed)
         num_new_chunks = 1;
     }
 
-    new_chunks = malloc((num_chunks + num_new_chunks) * sizeof(void *));
+    new_chunks = icalmemory_new_buffer((num_chunks + num_new_chunks) * sizeof(void *));
 
     if (new_chunks) {
         if (array->chunks && num_chunks) {
@@ -188,9 +192,13 @@ static void icalarray_expand(icalarray *array, size_t space_needed)
         }
         for (c = 0; c < num_new_chunks; c++) {
             new_chunks[c + num_chunks] = icalarray_alloc_chunk(array);
+            if (!new_chunks[c + num_chunks]) {
+                num_new_chunks = c;
+                break;
+            }
         }
         if (array->chunks) {
-            free(array->chunks);
+            icalmemory_free_buffer(array->chunks);
         }
         array->chunks = new_chunks;
         array->space_allocated = array->space_allocated + num_new_chunks * array->increment_size;