5679 be_sort_list(): Possible null pointer dereference

*** 24,33 ****
--- 24,34 ----
   */
  
  /*
   * Copyright 2013 Nexenta Systems, Inc. All rights reserved.
   * Copyright 2015 Toomas Soome <tsoome@me.com>
+  * Copyright 2015 Gary Mills
   */
  
  #include <assert.h>
  #include <libintl.h>
  #include <libnvpair.h>
*** 695,711 ****
  be_sort_list(be_node_list_t **pstart, int (*compar)(const void *, const void *))
  {
          size_t ibe, nbe;
          be_node_list_t *p = NULL;
          be_node_list_t **ptrlist = NULL;
  
          if (pstart == NULL)
                  return;
          /* build array of linked list BE struct pointers */
          for (p = *pstart, nbe = 0; p != NULL; nbe++, p = p->be_next_node) {
!                 ptrlist = realloc(ptrlist,
                      sizeof (be_node_list_t *) * (nbe + 2));
                  ptrlist[nbe] = p;
          }
          if (nbe == 0)
                  return;
          /* in-place list quicksort using qsort(3C) */
--- 696,719 ----
  be_sort_list(be_node_list_t **pstart, int (*compar)(const void *, const void *))
  {
          size_t ibe, nbe;
          be_node_list_t *p = NULL;
          be_node_list_t **ptrlist = NULL;
+         be_node_list_t **ptrtmp;
  
          if (pstart == NULL)
                  return;
          /* build array of linked list BE struct pointers */
          for (p = *pstart, nbe = 0; p != NULL; nbe++, p = p->be_next_node) {
!                 ptrtmp = realloc(ptrlist,
                      sizeof (be_node_list_t *) * (nbe + 2));
+                 if (ptrtmp == NULL) { /* out of memory */
+                         be_print_err(gettext("be_sort_list: memory "
+                             "allocation failed\n"));
+                         goto free;
+                 }
+                 ptrlist = ptrtmp;
                  ptrlist[nbe] = p;
          }
          if (nbe == 0)
                  return;
          /* in-place list quicksort using qsort(3C) */