5679 be_sort_list(): Possible null pointer dereference

@@ -24,10 +24,11 @@
  */
 
 /*
  * Copyright 2013 Nexenta Systems, Inc. All rights reserved.
  * Copyright 2015 Toomas Soome <tsoome@me.com>
+ * Copyright 2015 Gary Mills
  */
 
 #include <assert.h>
 #include <libintl.h>
 #include <libnvpair.h>

@@ -695,17 +696,24 @@
 be_sort_list(be_node_list_t **pstart, int (*compar)(const void *, const void *))
 {
         size_t ibe, nbe;
         be_node_list_t *p = NULL;
         be_node_list_t **ptrlist = NULL;
+        be_node_list_t **ptrtmp;
 
         if (pstart == NULL)
                 return;
         /* build array of linked list BE struct pointers */
         for (p = *pstart, nbe = 0; p != NULL; nbe++, p = p->be_next_node) {
-                ptrlist = realloc(ptrlist,
+                ptrtmp = realloc(ptrlist,
                     sizeof (be_node_list_t *) * (nbe + 2));
+                if (ptrtmp == NULL) { /* out of memory */
+                        be_print_err(gettext("be_sort_list: memory "
+                            "allocation failed\n"));
+                        goto free;
+                }
+                ptrlist = ptrtmp;
                 ptrlist[nbe] = p;
         }
         if (nbe == 0)
                 return;
         /* in-place list quicksort using qsort(3C) */