AmendHub

--- bile.c Sat Dec 6 15:03:15 2025 +++ bile.c Tue Sep 22 14:19:47 2026 @@ -63,15 +63,16 @@ bile_create(const Str255 filename, short vrefnum, cons /* create file */ _bile_error = Create(filename, vrefnum, creator, type); if (_bile_error) - return NULL; + goto create_bail; _bile_error = FSOpen(filename, vrefnum, &fh); if (_bile_error) - return NULL; + goto create_bail; _bile_error = SetEOF(fh, BILE_ALLOCATE_SIZE); if (_bile_error) - return NULL; + goto create_bail; + SetFPos(fh, fsFromStart, 0); memcpy(bile->magic, BILE_MAGIC, sizeof(bile->magic)); @@ -672,6 +673,7 @@ bile_resize(struct bile *bile, const OSType type, ret = bile_read_object(bile, o, data, o->size); if (ret != o->size) { _bile_error = bile->last_error = -1; + xfree(&data); return 0; } @@ -817,13 +819,16 @@ bile_unmarshall_object(struct bile *bile, for (off = 0, n = 0; n < nfields; n++) { if (fields[n].size < 0) { /* dynamically-sized field, read length */ + if (off + sizeof(fsize) > data_size) + panic("bile_unmarshall_object: truncated length at field " + "%lu of %lu", n + 1, nfields); memcpy(&fsize, (char *)data + off, sizeof(fsize)); off += sizeof(fsize); } else fsize = fields[n].size; - if (off + fsize > data_size) - panic("bile_unmarshall_object: overflow at field %lu of %lu!", + if (fsize > data_size - off) + panic("bile_unmarshall_object: overflow at field %lu of %lu", n + 1, nfields); ptr = (char *)object + fields[n].struct_off; @@ -1031,7 +1036,7 @@ bile_read_map(struct bile *bile, struct bile_object *m short bile_write_map(struct bile *bile) { - struct bile_object *obj, *new_map_obj, *new_map, + struct bile_object saved_map_obj, *obj, *new_map_obj, *new_map, *new_map_obj_in_new_map = NULL; size_t new_map_size, new_nobjects, new_map_id; size_t n; @@ -1057,9 +1062,8 @@ bile_write_map(struct bile *bile) _bile_error = bile->last_error = BILE_ERR_NO_MEMORY; return BILE_ERR_NO_MEMORY; } - new_map = xcalloc(BILE_OBJECT_SIZE, new_nobjects); + new_map = xcalloc(BILE_OBJECT_SIZE, bile->nobjects); if (new_map == NULL) { - xfree(&new_map_obj); _bile_error = bile->last_error = BILE_ERR_NO_MEMORY; return BILE_ERR_NO_MEMORY; } @@ -1107,15 +1111,16 @@ bile_write_map(struct bile *bile) } /* successfully wrote new map, switch over */ + saved_map_obj = *new_map_obj; xfree(&bile->map); bile->nobjects = new_nobjects; bile->map = new_map; bile->old_map_ptr.pos = bile->map_ptr.pos; bile->old_map_ptr.size = bile->map_ptr.size; bile->old_map_ptr.id = bile->map_ptr.id; - bile->map_ptr.pos = new_map_obj->pos; - bile->map_ptr.size = new_map_obj->size; - bile->map_ptr.id = new_map_obj->id; + bile->map_ptr.pos = saved_map_obj.pos; + bile->map_ptr.size = saved_map_obj.size; + bile->map_ptr.id = saved_map_obj.id; /* write new pointer to point at new map object */ bile_xwriteat(bile, BILE_MAGIC_LEN, &bile->map_ptr,