From 8b701bd3d7234fd9e8ba54f72782a64aac8b2e76 Mon Sep 17 00:00:00 2001 From: Ilia Alshanetsky Date: Sun, 6 Sep 2026 10:52:39 -0400 Subject: [PATCH] TSRM: roll back id_count when the resource type table cannot grow ts_allocate_id(), ts_allocate_fast_id_at() and ts_allocate_tls_id() increment id_count before growing resource_types_table. When the realloc fails they return 0 with id_count still counting the new slot, so allocate_new_resource() later walks j < id_count and reads an entry that was never initialized. Roll id_count back on those three paths. Closes GH-23595 --- TSRM/TSRM.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/TSRM/TSRM.c b/TSRM/TSRM.c index a5032e456aae..a9f6ed5c59bb 100644 --- a/TSRM/TSRM.c +++ b/TSRM/TSRM.c @@ -305,6 +305,7 @@ TSRM_API ts_rsrc_id ts_allocate_id(ts_rsrc_id *rsrc_id, size_t size, ts_allocate _tmp = (tsrm_resource_type *) realloc(resource_types_table, sizeof(tsrm_resource_type)*id_count); if (!_tmp) { TSRM_ERROR((TSRM_ERROR_LEVEL_ERROR, "Unable to allocate storage for resource")); + id_count--; *rsrc_id = 0; tsrm_mutex_unlock(tsmm_mutex); return 0; @@ -384,6 +385,7 @@ TSRM_API ts_rsrc_id ts_allocate_fast_id_at(ts_rsrc_id *rsrc_id, size_t *offset, _tmp = (tsrm_resource_type *) realloc(resource_types_table, sizeof(tsrm_resource_type)*id_count); if (!_tmp) { TSRM_ERROR((TSRM_ERROR_LEVEL_ERROR, "Unable to allocate storage for resource")); + id_count--; *rsrc_id = 0; tsrm_mutex_unlock(tsmm_mutex); return 0; @@ -419,6 +421,7 @@ TSRM_API ts_rsrc_id ts_allocate_tls_id(ts_rsrc_id *rsrc_id, void *(*tls_addr)(vo _tmp = (tsrm_resource_type *) realloc(resource_types_table, sizeof(tsrm_resource_type)*id_count); if (!_tmp) { TSRM_ERROR((TSRM_ERROR_LEVEL_ERROR, "Unable to allocate storage for resource")); + id_count--; *rsrc_id = 0; tsrm_mutex_unlock(tsmm_mutex); return 0;