tdf#120703 (PVS): handle failed realloc

V701 realloc() possible leak: when realloc() fails in allocating memory, original
pointer 'mpChunk' is lost. Consider assigning realloc() to a temporary pointer.

Change-Id: If85475cf22ea10e4db35532724d947e4e9005e91
Reviewed-on: https://gerrit.libreoffice.org/62091
Tested-by: Jenkins
Reviewed-by: Mike Kaganski <mike.kaganski@collabora.com>

1 files changed, 8 insertions, 2 deletions

diff --git a/sax/source/tools/fastattribs.cxx b/sax/source/tools/fastattribs.cxx
index b8d1bacec630..d7ecbc1bd13d 100644
--- a/sax/source/tools/fastattribs.cxx
+++ b/sax/source/tools/fastattribs.cxx
@@ -85,8 +85,14 @@ void FastAttributeList::add( sal_Int32 nToken, const sal_Char* pValue, size_t nV
     maAttributeValues.push_back( maAttributeValues.back() + nValueLength + 1 );
     if (maAttributeValues.back() > mnChunkLength)
     {
-        mnChunkLength = std::max(mnChunkLength * 2, maAttributeValues.back());
-        mpChunk = static_cast<sal_Char *>(realloc( mpChunk, mnChunkLength ));
+        const sal_Int32 newLen = std::max(mnChunkLength * 2, maAttributeValues.back());
+        if (auto p = static_cast<sal_Char*>(realloc(mpChunk, newLen)))
+        {
+            mnChunkLength = newLen;
+            mpChunk = p;
+        }
+        else
+            throw std::bad_alloc();
     }
     strncpy(mpChunk + nWritePosition, pValue, nValueLength);
     mpChunk[nWritePosition + nValueLength] = '\0';