From b46029ddecf600518ef5d51352613f4f709f7856 Mon Sep 17 00:00:00 2001
From: Alok Kumar Mishra <152197161+IndAlok@users.noreply.github.com>
Date: Sun, 12 Apr 2026 14:46:24 +0530
Subject: [PATCH] librz/util: guard allocation failure paths in string and
 vector helpers (#6217)

---
 librz/util/str.c    | 8 ++++++--
 librz/util/strbuf.c | 4 ++++
 librz/util/vector.c | 3 +++
 3 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/librz/util/str.c b/librz/util/str.c
index 888f666907..09fcf13954 100644
--- a/librz/util/str.c
+++ b/librz/util/str.c
@@ -2627,7 +2627,9 @@ RZ_API char *rz_str_arg_escape(const char *arg) {
 		}
 	}
 	str[dest_i] = '\0';
-	return realloc(str, (strlen(str) + 1) * sizeof(char));
+	char *trimmed = realloc(str, (strlen(str) + 1) * sizeof(char));
+	// keep the valid oversized buffer if realloc fails.
+	return trimmed ? trimmed : str;
 }
 
 // Unescape the string arg to its original format
@@ -2678,7 +2680,9 @@ RZ_API char *rz_str_path_escape(const char *path) {
 	}
 
 	str[dest_i] = '\0';
-	return realloc(str, (strlen(str) + 1) * sizeof(char));
+	char *trimmed = realloc(str, (strlen(str) + 1) * sizeof(char));
+	// same as above, logic is similar to rz_str_uri_encode.
+	return trimmed ? trimmed : str;
 }
 
 RZ_API int rz_str_path_unescape(char *path) {
diff --git a/librz/util/strbuf.c b/librz/util/strbuf.c
index e66b9560e2..6aa4b8360c 100644
--- a/librz/util/strbuf.c
+++ b/librz/util/strbuf.c
@@ -239,6 +239,10 @@ RZ_API bool rz_strbuf_append_n(RzStrBuf *sb, const char *s, size_t l) {
 			}
 			newlen *= 2;
 			p = realloc(sb->ptr, newlen);
+			// preserve the existing buffer on OOM
+			if (!p) {
+				return false;
+			}
 			memset((char *)p + sb->ptrlen, 0, newlen - sb->ptrlen);
 		} else {
 			allocated = false;
diff --git a/librz/util/vector.c b/librz/util/vector.c
index 7680d79343..eec7f451ce 100644
--- a/librz/util/vector.c
+++ b/librz/util/vector.c
@@ -167,6 +167,9 @@ RZ_API bool rz_vector_clone_into(
 RZ_API RZ_OWN RzVector *rz_vector_clone(
 	RZ_NONNULL RZ_BORROW RZ_IN const RzVector *vec) {
 	RzVector *dst = rz_vector_clonef(vec, NULL);
+	if (!dst) {
+		return NULL;
+	}
 	dst->free = NULL;
 	dst->free_user = NULL;
 	return dst;