Possible NULL pointer dereference in GCC's vec code?

[Jeff Law]

Consider this code in va_gc::reserve:


template<typename T, typename A>
void
va_gc::reserve (vec<T, A, vl_embed> *&v, unsigned reserve, bool exact
                 MEM_STAT_DECL)
{
   unsigned alloc
     = vec_prefix::calculate_allocation (v ? &v->vecpfx_ : 0, reserve, 
exact);
   if (!alloc)
     {
       ::ggc_free (v);
       v = NULL;
       return;
     }
[ ... ]


Note how it assigns NULL to v.

Now consider how this gets used in other vec code:

/* If V has no room for one more element, reallocate it.  Then call
    V->quick_push(OBJ).  */
template<typename T, typename A>
inline T *
vec_safe_push (vec<T, A, vl_embed> *&v, const T &obj CXX_MEM_STAT_INFO)
{
   vec_safe_reserve (v, 1, false PASS_MEM_STAT);
   return v->quick_push (obj);
}


/* if V has no room for one more element, reallocate it.  Then call
    V->quick_insert(IX, OBJ).  */
template<typename T, typename A>
inline void
vec_safe_insert (vec<T, A, vl_embed> *&v, unsigned ix, const T &obj
                  CXX_MEM_STAT_INFO)
{
   vec_safe_reserve (v, 1, false PASS_MEM_STAT);
   v->quick_insert (ix, obj);
}


So vec_prefix::calculate_allocation returns NULL, then 
vec_safe_{push,insert} (and possibly others) can dereference a NULL 
pointer if I'm reading the code correctly.

Similarly, the vec_save_{insert,push} will use a pointer after it has 
been freed for heap allocations:


template<typename T>
inline void
va_heap::reserve (vec<T, va_heap, vl_embed> *&v, unsigned reserve, bool 
exact
                   MEM_STAT_DECL)
{
   unsigned alloc
     = vec_prefix::calculate_allocation (v ? &v->vecpfx_ : 0, reserve, 
exact);
   if (!alloc)
     {
       release (v);
       return;
     }
[ ... [

Note how we release v, so we have a use-after-free scenario here if 
vec_prefix::calculate_allocation ever returns null.

Thoughts/comments?

Jeff