bokftui: fix heap overflow in ib_load (rows vs vouchers)v0.1.10

The IB list arrays were sized by voucher count but appended per row; a
single IB voucher with more than one row overwrote the heap and crashed
after leaving the view. Grow the arrays dynamically.

1 files changed, 8 insertions, 2 deletions

diff --git a/clients/bokftui.c b/clients/bokftui.c
index 4ce5a62..15ca335 100644
--- a/clients/bokftui.c
+++ b/clients/bokftui.c
@@ -3189,8 +3189,9 @@ static int ib_load(struct app *a, char ***out_acc, int64_t **out_amt,
         return -1;
     }
     size_t n = jarr_size(resp, "result.items");
-    char **accs = xcalloc(n ? n : 1, sizeof(char *));
-    int64_t *amts = xcalloc(n ? n : 1, sizeof(int64_t));
+    size_t cap = n ? n : 1;
+    char **accs = xcalloc(cap, sizeof(char *));
+    int64_t *amts = xcalloc(cap, sizeof(int64_t));
     int count = 0;
     for (size_t i = 0; i < n; i++) {
         char path[64];
@@ -3224,6 +3225,11 @@ static int ib_load(struct app *a, char ***out_acc, int64_t **out_amt,
                 if (found >= 0) {
                     amts[found] += d - c;
                 } else {
+                    if ((size_t)count == cap) {
+                        cap *= 2;
+                        accs = xrealloc(accs, cap * sizeof(char *));
+                        amts = xrealloc(amts, cap * sizeof(int64_t));
+                    }
                     accs[count] = acc;
                     amts[count] = d - c;
                     count++;