CI updates

.github/workflows/ci.yml

@@ -633,9 +633,9 @@ jobs:
           - { zig_target: x86_64-windows-gnu }
     name: ${{ format('zigcc {0} {1}', matrix.zig_target, matrix.zig_pic) }}
     runs-on: ubuntu-latest
-    container: ${{ matrix.container || 'alpine:3.23' }}
+    container: ${{ matrix.container || 'alpine:3.22' }}
     env:
-      container: ${{ matrix.container || 'alpine:3.23' }}
+      container: ${{ matrix.container || 'alpine:3.22' }}
       UPX_CONFIG_HAVE_WORKING_BUILD_RPATH: ''
       # for zig-cc wrapper scripts (see below):
       ZIG_CPPFLAGS: -DUPX_DOCTEST_CONFIG_MULTITHREADING

src/linker.cpp

@@ -368,7 +368,7 @@ int ElfLinker::addLoader(const char *sname) {
 
     char *begin = strdup(sname);
     assert(begin != nullptr);
-    auto begin_deleter = upx::MallocDeleter(&begin, 1);
+    const auto begin_deleter = upx::MallocDeleter(&begin, 1); // don't leak memory
     char *end = begin + strlen(begin);
     for (char *sect = begin; sect < end;) {
         for (char *tokend = sect; *tokend; tokend++)

src/pefile.cpp

@@ -1737,14 +1737,16 @@ PeFile::Resource::upx_rnode *PeFile::Resource::convert(const void *rnode, upx_rn
     branch->parent = parent;
     branch->nc = ic;
     branch->children = New(upx_rnode *, ic);
+    // NOLINTNEXTLINE(bugprone-multi-level-implicit-pointer-conversion)
+    memset(branch->children, 0, sizeof(upx_rnode *) * ic);
     branch->data = *node;
     if (!root)         // first one
         root = branch; // prevent leak if xcheck throws (hacked unpack or test)
 
     for (const res_dir_entry *rde = node->entries + ic - 1; --ic >= 0; rde--) {
         upx_rnode *child = convert(start + (rde->child & 0x7fffffff), branch, level + 1);
-        xcheck(child);
         branch->children[ic] = child;
+        xcheck(child);
         child->id = rde->tnl;
         if (child->id & 0x80000000) {
             const byte *p = start + (child->id & 0x7fffffff);