Fix invalid free() after failed realloc() (GHSA-gcx3-7m76-287p)

nanopb · Feb 1, 2020 · 7b39682 · 7b39682
1 parent c8e8fe1
commit 7b39682
Showing 1 changed file with 3 additions and 3 deletions.
diff --git a/pb_decode.c b/pb_decode.c
@@ -627,11 +627,11 @@ static bool checkreturn decode_pointer_field(pb_istream_t *stream, pb_wire_type_
                 size_t *size = (size_t*)iter->pSize;
                 void *pItem;
 
-                (*size)++;
-                if (!allocate_field(stream, iter->pData, iter->pos->data_size, *size))
+                if (!allocate_field(stream, iter->pData, iter->pos->data_size, (size_t)(*size + 1)))
                     return false;
 
-                pItem = *(uint8_t**)iter->pData + iter->pos->data_size * (*size - 1);
+                pItem = *(uint8_t**)iter->pData + iter->pos->data_size * (*size);
+                (*size)++;
                 initialize_pointer_field(pItem, iter);
                 return func(stream, iter->pos, pItem);
             }