From ec2febbb14c77213e615d935b86651dfd25311bb Mon Sep 17 00:00:00 2001 From: Anders Betts Date: Fri, 18 Sep 2026 09:43:06 +0200 Subject: bokftui: fix heap overflow in ib_load (rows vs vouchers) The IB list arrays were sized by voucher count but appended per row; a single IB voucher with more than one row overwrote the heap and crashed after leaving the view. Grow the arrays dynamically. --- clients/bokftui.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) (limited to 'clients/bokftui.c') diff --git a/clients/bokftui.c b/clients/bokftui.c index 4ce5a62..15ca335 100644 --- a/clients/bokftui.c +++ b/clients/bokftui.c @@ -3189,8 +3189,9 @@ static int ib_load(struct app *a, char ***out_acc, int64_t **out_amt, return -1; } size_t n = jarr_size(resp, "result.items"); - char **accs = xcalloc(n ? n : 1, sizeof(char *)); - int64_t *amts = xcalloc(n ? n : 1, sizeof(int64_t)); + size_t cap = n ? n : 1; + char **accs = xcalloc(cap, sizeof(char *)); + int64_t *amts = xcalloc(cap, sizeof(int64_t)); int count = 0; for (size_t i = 0; i < n; i++) { char path[64]; @@ -3224,6 +3225,11 @@ static int ib_load(struct app *a, char ***out_acc, int64_t **out_amt, if (found >= 0) { amts[found] += d - c; } else { + if ((size_t)count == cap) { + cap *= 2; + accs = xrealloc(accs, cap * sizeof(char *)); + amts = xrealloc(amts, cap * sizeof(int64_t)); + } accs[count] = acc; amts[count] = d - c; count++; -- cgit v1.3