- Fix a data storage incorrect reassignment after a realloc - cause of source view changes/content view update crashes, and almost certainly memory leaks and other crashes

1 files changed, 4 insertions, 5 deletions

diff --git a/Source/SPDataStorage.m b/Source/SPDataStorage.m
index 65153d2b..2da99409 100644
--- a/Source/SPDataStorage.m
+++ b/Source/SPDataStorage.m
@@ -339,12 +339,11 @@ static inline void SPDataStorageEnsureCapacityForAdditionalRowCount(SPDataStorag
 		// If the new column count is higher than the old count, iterate through the existing rows
 		// and pad with nils
 		if (columnCount > numColumns) {
-			while (i > 0) {
-				row = dataStorage[--i];
-				row = (id *)realloc(row, columnPointerByteSize);
+			while (i-- > 0) {
+				dataStorage[i] = (id *)realloc(dataStorage[i], columnPointerByteSize);
 				j = numColumns;
 				while (j < columnCount) {
-					row[j++] = nil;
+					dataStorage[i][j++] = nil;
 				}
 			}
 
@@ -357,7 +356,7 @@ static inline void SPDataStorageEnsureCapacityForAdditionalRowCount(SPDataStorag
 				while (j > columnCount) {
 					if (row[--j]) CFRelease(row[j]);
 				}
-				row = (id *)realloc(row, columnPointerByteSize);
+				dataStorage[i] = (id *)realloc(row, columnPointerByteSize);
 			}
 		}
 	}