From 669bf2251f9d8187d665fb13c4f461dc485ffd6d Mon Sep 17 00:00:00 2001
From: "Markus F.X.J. Oberhumer" <markus@oberhumer.com>
Date: Wed, 10 Dec 2025 12:30:09 +0100
Subject: [PATCH] CI updates

---
 .github/workflows/ci.yml | 4 ++--
 src/linker.cpp           | 2 +-
 src/pefile.cpp           | 4 +++-
 3 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 392d69d6..d3a670a8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -633,9 +633,9 @@ jobs:
           - { zig_target: x86_64-windows-gnu }
     name: ${{ format('zigcc {0} {1}', matrix.zig_target, matrix.zig_pic) }}
     runs-on: ubuntu-latest
-    container: ${{ matrix.container || 'alpine:3.23' }}
+    container: ${{ matrix.container || 'alpine:3.22' }}
     env:
-      container: ${{ matrix.container || 'alpine:3.23' }}
+      container: ${{ matrix.container || 'alpine:3.22' }}
       UPX_CONFIG_HAVE_WORKING_BUILD_RPATH: ''
       # for zig-cc wrapper scripts (see below):
       ZIG_CPPFLAGS: -DUPX_DOCTEST_CONFIG_MULTITHREADING
diff --git a/src/linker.cpp b/src/linker.cpp
index b6a0fefd..6f681f64 100644
--- a/src/linker.cpp
+++ b/src/linker.cpp
@@ -368,7 +368,7 @@ int ElfLinker::addLoader(const char *sname) {
 
     char *begin = strdup(sname);
     assert(begin != nullptr);
-    auto begin_deleter = upx::MallocDeleter(&begin, 1);
+    const auto begin_deleter = upx::MallocDeleter(&begin, 1); // don't leak memory
     char *end = begin + strlen(begin);
     for (char *sect = begin; sect < end;) {
         for (char *tokend = sect; *tokend; tokend++)
diff --git a/src/pefile.cpp b/src/pefile.cpp
index 0604f8da..a5cdba08 100644
--- a/src/pefile.cpp
+++ b/src/pefile.cpp
@@ -1737,14 +1737,16 @@ PeFile::Resource::upx_rnode *PeFile::Resource::convert(const void *rnode, upx_rn
     branch->parent = parent;
     branch->nc = ic;
     branch->children = New(upx_rnode *, ic);
+    // NOLINTNEXTLINE(bugprone-multi-level-implicit-pointer-conversion)
+    memset(branch->children, 0, sizeof(upx_rnode *) * ic);
     branch->data = *node;
     if (!root)         // first one
         root = branch; // prevent leak if xcheck throws (hacked unpack or test)
 
     for (const res_dir_entry *rde = node->entries + ic - 1; --ic >= 0; rde--) {
         upx_rnode *child = convert(start + (rde->child & 0x7fffffff), branch, level + 1);
-        xcheck(child);
         branch->children[ic] = child;
+        xcheck(child);
         child->id = rde->tnl;
         if (child->id & 0x80000000) {
             const byte *p = start + (child->id & 0x7fffffff);