static int eloop_sock_table_add_sock(struct eloop_sock_table *table,
                                     int sock, eloop_sock_handler handler,
                                     void *eloop_data, void *user_data)
{
	struct eloop_sock *tmp;
	int new_max_sock;

	if (sock > eloop.max_sock)
		new_max_sock = sock;
	else
		new_max_sock = eloop.max_sock;

	if (table == NULL)
		return -1;

#ifdef CONFIG_ELOOP_POLL
	if (new_max_sock >= eloop.max_pollfd_map) {
		struct pollfd **nmap;
		nmap = os_realloc_array(eloop.pollfds_map, new_max_sock + 50,
					sizeof(struct pollfd *));
		if (nmap == NULL)
			return -1;

		eloop.max_pollfd_map = new_max_sock + 50;
		eloop.pollfds_map = nmap;
	}

	if (eloop.count + 1 > eloop.max_poll_fds) {
		struct pollfd *n;
		int nmax = eloop.count + 1 + 50;
		n = os_realloc_array(eloop.pollfds, nmax,
				     sizeof(struct pollfd));
		if (n == NULL)
			return -1;

		eloop.max_poll_fds = nmax;
		eloop.pollfds = n;
	}
#endif /* CONFIG_ELOOP_POLL */

	eloop_trace_sock_remove_ref(table);
	tmp = os_realloc_array(table->table, table->count + 1,
			       sizeof(struct eloop_sock));
	if (tmp == NULL)
		return -1;

	tmp[table->count].sock = sock;
	tmp[table->count].eloop_data = eloop_data;
	tmp[table->count].user_data = user_data;
	tmp[table->count].handler = handler;
	wpa_trace_record(&tmp[table->count]);
	table->count++;
	table->table = tmp;
	eloop.max_sock = new_max_sock;
	eloop.count++;
	table->changed = 1;
	eloop_trace_sock_add_ref(table);

	return 0;
}

static int eloop_sock_table_add_sock(struct eloop_sock_table *table,
									 int sock, eloop_sock_handler handler, void *eloop_data, void *user_data)
{
	struct eloop_sock *tmp;
	int new_max_sock;

	if (sock > eloop.max_sock)
		new_max_sock = sock;
	else
		new_max_sock = eloop.max_sock;

	if (table == NULL)
		return -1;

	if (new_max_sock >= eloop.max_pollfd_map) {
		struct pollfd **nmap;
		nmap = os_realloc_array(eloop.pollfds_map, new_max_sock + 50, sizeof(struct pollfd *));
		if (nmap == NULL)
			return -1;

		eloop.max_pollfd_map = new_max_sock + 50;
		eloop.pollfds_map = nmap;
	}

	if (eloop.count + 1 > eloop.max_poll_fds) {
		struct pollfd *n;
		int nmax = eloop.count + 1 + 50;
		n = os_realloc_array(eloop.pollfds, nmax, sizeof(struct pollfd));
		if (n == NULL)
			return -1;

		eloop.max_poll_fds = nmax;
		eloop.pollfds = n;
	}

	tmp = os_realloc_array(table->table, table->count + 1, sizeof(struct eloop_sock));
	if (tmp == NULL)
		return -1;

	tmp[table->count].sock = sock;
	tmp[table->count].eloop_data = eloop_data;
	tmp[table->count].user_data = user_data;
	tmp[table->count].handler = handler;
	table->count++;
	table->table = tmp;
	eloop.max_sock = new_max_sock;
	eloop.count++;
	table->changed = 1;

	return 0;
}

static int * bgscan_learn_get_supp_freqs(struct wpa_supplicant *wpa_s)
{
	struct hostapd_hw_modes *modes;
	int i, j, *freqs = NULL, *n;
	size_t count = 0;

	modes = wpa_s->hw.modes;
	if (modes == NULL)
		return NULL;

	for (i = 0; i < wpa_s->hw.num_modes; i++) {
		for (j = 0; j < modes[i].num_channels; j++) {
			if (modes[i].channels[j].flag & HOSTAPD_CHAN_DISABLED)
				continue;
			/* some hw modes (e.g. 11b & 11g) contain same freqs */
			if (in_array(freqs, modes[i].channels[j].freq))
				continue;
			n = os_realloc_array(freqs, count + 2, sizeof(int));
			if (n == NULL)
				continue;

			freqs = n;
			freqs[count] = modes[i].channels[j].freq;
			count++;
			freqs[count] = 0;
		}
	}

	return freqs;
}

static int * bgscan_learn_get_probe_freq(struct bgscan_learn_data *data,
					 int *freqs, size_t count)
{
	int idx, *n;

	if (data->supp_freqs == NULL)
		return freqs;

	idx = data->probe_idx;
	do {
		if (!in_array(freqs, data->supp_freqs[idx])) {
			wpa_printf(MSG_DEBUG, "bgscan learn: Probe new freq "
				   "%u", data->supp_freqs[idx]);
			data->probe_idx = idx + 1;
			if (data->supp_freqs[data->probe_idx] == 0)
				data->probe_idx = 0;
			n = os_realloc_array(freqs, count + 2, sizeof(int));
			if (n == NULL)
				return freqs;
			freqs = n;
			freqs[count] = data->supp_freqs[idx];
			count++;
			freqs[count] = 0;
			break;
		}

		idx++;
		if (data->supp_freqs[idx] == 0)
			idx = 0;
	} while (idx != data->probe_idx);

	return freqs;
}

struct p2p_group * p2p_group_init(struct p2p_data *p2p,
				  struct p2p_group_config *config)
{
	struct p2p_group *group, **groups;

	group = os_zalloc(sizeof(*group));
	if (group == NULL)
		return NULL;

	groups = os_realloc_array(p2p->groups, p2p->num_groups + 1,
				  sizeof(struct p2p_group *));
	if (groups == NULL) {
		os_free(group);
		return NULL;
	}
	groups[p2p->num_groups++] = group;
	p2p->groups = groups;

	group->p2p = p2p;
	group->cfg = config;
	group->group_formation = 1;
	group->beacon_update = 1;
	p2p_group_update_ies(group);
	group->cfg->idle_update(group->cfg->cb_ctx, 1);

	return group;
}

int eloop_register_event(void *event, size_t event_size,
			 eloop_event_handler handler,
			 void *eloop_data, void *user_data)
{
	struct eloop_event *tmp;
	HANDLE h = event;

	if (event_size != sizeof(HANDLE) || h == INVALID_HANDLE_VALUE)
		return -1;

	if (eloop_prepare_handles())
		return -1;

	tmp = os_realloc_array(eloop.events, eloop.event_count + 1,
			       sizeof(struct eloop_event));
	if (tmp == NULL)
		return -1;

	tmp[eloop.event_count].eloop_data = eloop_data;
	tmp[eloop.event_count].user_data = user_data;
	tmp[eloop.event_count].handler = handler;
	tmp[eloop.event_count].event = h;
	eloop.event_count++;
	eloop.events = tmp;

	return 0;
}

/**
 * radius_client_register - Register a RADIUS client RX handler
 * @radius: RADIUS client context from radius_client_init()
 * @msg_type: RADIUS client type (RADIUS_AUTH or RADIUS_ACCT)
 * @handler: Handler for received RADIUS messages
 * @data: Context pointer for handler callbacks
 * Returns: 0 on success, -1 on failure
 *
 * This function is used to register a handler for processing received RADIUS
 * authentication and accounting messages. The handler() callback function will
 * be called whenever a RADIUS message is received from the active server.
 *
 * There can be multiple registered RADIUS message handlers. The handlers will
 * be called in order until one of them indicates that it has processed or
 * queued the message.
 */
int radius_client_register(struct radius_client_data *radius,
			   RadiusType msg_type,
			   RadiusRxResult (*handler)(struct radius_msg *msg,
						     struct radius_msg *req,
						     const u8 *shared_secret,
						     size_t shared_secret_len,
						     void *data),
			   void *data)
{
	struct radius_rx_handler **handlers, *newh;
	size_t *num;

	if (msg_type == RADIUS_ACCT) {
		handlers = &radius->acct_handlers;
		num = &radius->num_acct_handlers;
	} else {
		handlers = &radius->auth_handlers;
		num = &radius->num_auth_handlers;
	}

	newh = os_realloc_array(*handlers, *num + 1,
				sizeof(struct radius_rx_handler));
	if (newh == NULL)
		return -1;

	newh[*num].handler = handler;
	newh[*num].data = data;
	(*num)++;
	*handlers = newh;

	return 0;
}

static void add_alt_name_othername(struct http_ctx *ctx, struct http_cert *cert,
				   OTHERNAME *o)
{
	char txt[100];
	int res;
	struct http_othername *on;
	ASN1_TYPE *val;

	on = os_realloc_array(cert->othername, cert->num_othername + 1,
			      sizeof(struct http_othername));
	if (on == NULL)
		return;
	cert->othername = on;
	on = &on[cert->num_othername];
	os_memset(on, 0, sizeof(*on));

	res = OBJ_obj2txt(txt, sizeof(txt), o->type_id, 1);
	if (res < 0 || res >= (int) sizeof(txt))
		return;

	on->oid = os_strdup(txt);
	if (on->oid == NULL)
		return;

	val = o->value;
	on->data = val->value.octet_string->data;
	on->len = val->value.octet_string->length;

	cert->num_othername++;
}

static void sme_sa_query_timer(void *eloop_ctx, void *timeout_ctx)
{
	struct wpa_supplicant *wpa_s = eloop_ctx;
	unsigned int timeout, sec, usec;
	u8 *trans_id, *nbuf;

	if (wpa_s->sme.sa_query_count > 0 &&
	    sme_check_sa_query_timeout(wpa_s))
		return;

	nbuf = os_realloc_array(wpa_s->sme.sa_query_trans_id,
				wpa_s->sme.sa_query_count + 1,
				WLAN_SA_QUERY_TR_ID_LEN);
	if (nbuf == NULL)
		return;
	if (wpa_s->sme.sa_query_count == 0) {
		/* Starting a new SA Query procedure */
		os_get_time(&wpa_s->sme.sa_query_start);
	}
	trans_id = nbuf + wpa_s->sme.sa_query_count * WLAN_SA_QUERY_TR_ID_LEN;
	wpa_s->sme.sa_query_trans_id = nbuf;
	wpa_s->sme.sa_query_count++;

	os_get_random(trans_id, WLAN_SA_QUERY_TR_ID_LEN);

	timeout = sa_query_retry_timeout;
	sec = ((timeout / 1000) * 1024) / 1000;
	usec = (timeout % 1000) * 1024;
	eloop_register_timeout(sec, usec, sme_sa_query_timer, wpa_s, NULL);

	wpa_dbg(wpa_s, MSG_DEBUG, "SME: Association SA Query attempt %d",
		wpa_s->sme.sa_query_count);

	sme_send_sa_query_req(wpa_s, trans_id);
}

static void
wpa_driver_bsd_add_scan_entry(struct wpa_scan_results *res,
			      struct ieee80211req_scan_result *sr)
{
	struct wpa_scan_res *result, **tmp;
	size_t extra_len;
	u8 *pos;

	extra_len = 2 + sr->isr_ssid_len;
	extra_len += 2 + sr->isr_nrates;
	extra_len += 3; /* ERP IE */
	extra_len += sr->isr_ie_len;

	result = os_zalloc(sizeof(*result) + extra_len);
	if (result == NULL)
		return;
	os_memcpy(result->bssid, sr->isr_bssid, ETH_ALEN);
	result->freq = sr->isr_freq;
	result->beacon_int = sr->isr_intval;
	result->caps = sr->isr_capinfo;
	result->qual = sr->isr_rssi;
	result->noise = sr->isr_noise;

	pos = (u8 *)(result + 1);

	*pos++ = WLAN_EID_SSID;
	*pos++ = sr->isr_ssid_len;
	os_memcpy(pos, sr + 1, sr->isr_ssid_len);
	pos += sr->isr_ssid_len;

	/*
	 * Deal all rates as supported rate.
	 * Because net80211 doesn't report extended supported rate or not.
	 */
	*pos++ = WLAN_EID_SUPP_RATES;
	*pos++ = sr->isr_nrates;
	os_memcpy(pos, sr->isr_rates, sr->isr_nrates);
	pos += sr->isr_nrates;

	*pos++ = WLAN_EID_ERP_INFO;
	*pos++ = 1;
	*pos++ = sr->isr_erp;

	os_memcpy(pos, (u8 *)(sr + 1) + sr->isr_ssid_len, sr->isr_ie_len);
	pos += sr->isr_ie_len;

	result->ie_len = pos - (u8 *)(result + 1);

	tmp = os_realloc_array(res->res, res->num + 1,
			       sizeof(struct wpa_scan_res *));
	if (tmp == NULL) {
		os_free(result);
		return;
	}
	tmp[res->num++] = result;
	res->res = tmp;
}

static dbus_bool_t _wpa_dbus_dict_entry_get_binarray(
	DBusMessageIter *iter, struct wpa_dbus_dict_entry *entry)
{
	struct wpa_dbus_dict_entry tmpentry;
	size_t buflen = 0;
	int i;

	if (dbus_message_iter_get_element_type(iter) != DBUS_TYPE_BYTE)
		return FALSE;

	entry->array_type = WPAS_DBUS_TYPE_BINARRAY;
	entry->array_len = 0;
	entry->binarray_value = NULL;

	while (dbus_message_iter_get_arg_type(iter) == DBUS_TYPE_ARRAY) {
		DBusMessageIter iter_array;

		if (entry->array_len == buflen) {
			struct wpabuf **newbuf;

			buflen += BIN_ARRAY_CHUNK_SIZE;

			newbuf = os_realloc_array(entry->binarray_value,
						  buflen, BIN_ARRAY_ITEM_SIZE);
			if (!newbuf)
				goto cleanup;
			entry->binarray_value = newbuf;
		}

		dbus_message_iter_recurse(iter, &iter_array);
		if (_wpa_dbus_dict_entry_get_byte_array(&iter_array, &tmpentry)
					== FALSE)
			goto cleanup;

		entry->binarray_value[entry->array_len] =
			wpabuf_alloc_ext_data((u8 *) tmpentry.bytearray_value,
					      tmpentry.array_len);
		if (entry->binarray_value[entry->array_len] == NULL) {
			wpa_dbus_dict_entry_clear(&tmpentry);
			goto cleanup;
		}
		entry->array_len++;
		dbus_message_iter_next(iter);
	}

	return TRUE;

 cleanup:
	for (i = 0; i < (int) entry->array_len; i++)
		wpabuf_free(entry->binarray_value[i]);
	os_free(entry->binarray_value);
	entry->array_len = 0;
	entry->binarray_value = NULL;
	return FALSE;
}

/**
 * Decrease the usage counter for given ifname.
 * Returns
 *     -1 on error or if iface was not found
 *     0 if iface was found and is still present
 *     1 if iface was removed from global list
 */
static int hapd_put_dynamic_iface(const char *parent, const char *ifname,
				  struct hostapd_data *hapd)
{
	size_t i;
	struct hostapd_dynamic_iface *j = NULL, **tmp;
	struct hapd_interfaces *hapd_glob = hapd->iface->interfaces;

	if (!parent)
		parent = "";

	for (i = 0; i < hapd_glob->count_dynamic; i++) {
		j = hapd_glob->dynamic_iface[i];
		if (os_strncmp(j->iface, ifname, sizeof(j->iface)) == 0 &&
		    os_strncmp(j->parent, parent, sizeof(j->parent)) == 0)
			break;
	}

	if (i == hapd_glob->count_dynamic) {
		/*
		 * Interface not in global list. This can happen if alloc in
		 * _get_ failed.
		 */
		return -1;
	}

	if (j->usage > 0) {
		j->usage--;
		return 0;
	}

	os_free(j);
	for (; i < hapd_glob->count_dynamic - 1; i++)
		hapd_glob->dynamic_iface[i] = hapd_glob->dynamic_iface[i + 1];
	hapd_glob->dynamic_iface[hapd_glob->count_dynamic - 1] = NULL;
	hapd_glob->count_dynamic--;

	if (hapd_glob->count_dynamic == 0) {
		os_free(hapd_glob->dynamic_iface);
		hapd_glob->dynamic_iface = NULL;
		return 1;
	}

	tmp = os_realloc_array(hapd_glob->dynamic_iface,
			       hapd_glob->count_dynamic,
			       sizeof(*hapd_glob->dynamic_iface));
	if (!tmp) {
		wpa_printf(MSG_ERROR, "VLAN: Failed to release memory in %s",
			   __func__);
		return -1;
	}
	hapd_glob->dynamic_iface = tmp;

	return 1;
}

static dbus_bool_t _wpa_dbus_dict_entry_get_byte_array(
	DBusMessageIter *iter, struct wpa_dbus_dict_entry *entry)
{
	dbus_uint32_t count = 0;
	dbus_bool_t success = FALSE;
	char *buffer, *nbuffer;

	entry->bytearray_value = NULL;
	entry->array_type = DBUS_TYPE_BYTE;

	buffer = os_calloc(BYTE_ARRAY_CHUNK_SIZE, BYTE_ARRAY_ITEM_SIZE);
	if (!buffer)
		return FALSE;

	entry->bytearray_value = buffer;
	entry->array_len = 0;
	while (dbus_message_iter_get_arg_type(iter) == DBUS_TYPE_BYTE) {
		char byte;

		if ((count % BYTE_ARRAY_CHUNK_SIZE) == 0 && count != 0) {
			nbuffer = os_realloc_array(
				buffer, count + BYTE_ARRAY_CHUNK_SIZE,
				BYTE_ARRAY_ITEM_SIZE);
			if (nbuffer == NULL) {
				os_free(buffer);
				wpa_printf(MSG_ERROR, "dbus: _wpa_dbus_dict_"
					   "entry_get_byte_array out of "
					   "memory trying to retrieve the "
					   "string array");
				goto done;
			}
			buffer = nbuffer;
		}
		entry->bytearray_value = buffer;

		dbus_message_iter_get_basic(iter, &byte);
		entry->bytearray_value[count] = byte;
		entry->array_len = ++count;
		dbus_message_iter_next(iter);
	}

	/* Zero-length arrays are valid. */
	if (entry->array_len == 0) {
		os_free(entry->bytearray_value);
		entry->bytearray_value = NULL;
	}

	success = TRUE;

done:
	return success;
}

static int eloop_prepare_handles(void)
{
	HANDLE *n;

	if (eloop.num_handles > eloop.reader_count + eloop.event_count + 8)
		return 0;
	n = os_realloc_array(eloop.handles, eloop.num_handles * 2,
			     sizeof(eloop.handles[0]));
	if (n == NULL)
		return -1;
	eloop.handles = n;
	eloop.num_handles *= 2;
	return 0;
}

static void ap_sa_query_timer(void *eloop_ctx, void *timeout_ctx)
{
    struct hostapd_data *hapd = eloop_ctx;
    struct sta_info *sta = timeout_ctx;
    unsigned int timeout, sec, usec;
    u8 *trans_id, *nbuf;

    wpa_printf(MSG_DEBUG, "%s: SA Query timer for STA " MACSTR
               " (count=%d)",
               hapd->conf->iface, MAC2STR(sta->addr), sta->sa_query_count);

    if (sta->sa_query_count > 0 &&
            ap_check_sa_query_timeout(hapd, sta))
        return;

    nbuf = os_realloc_array(sta->sa_query_trans_id,
                            sta->sa_query_count + 1,
                            WLAN_SA_QUERY_TR_ID_LEN);
    if (nbuf == NULL)
        return;
    if (sta->sa_query_count == 0) {
        /* Starting a new SA Query procedure */
        os_get_reltime(&sta->sa_query_start);
    }
    trans_id = nbuf + sta->sa_query_count * WLAN_SA_QUERY_TR_ID_LEN;
    sta->sa_query_trans_id = nbuf;
    sta->sa_query_count++;

    if (os_get_random(trans_id, WLAN_SA_QUERY_TR_ID_LEN) < 0) {
        /*
         * We don't really care which ID is used here, so simply
         * hardcode this if the mostly theoretical os_get_random()
         * failure happens.
         */
        trans_id[0] = 0x12;
        trans_id[1] = 0x34;
    }

    timeout = hapd->conf->assoc_sa_query_retry_timeout;
    sec = ((timeout / 1000) * 1024) / 1000;
    usec = (timeout % 1000) * 1024;
    eloop_register_timeout(sec, usec, ap_sa_query_timer, hapd, sta);

    hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
                   HOSTAPD_LEVEL_DEBUG,
                   "association SA Query attempt %d", sta->sa_query_count);

    ieee802_11_send_sa_query_req(hapd, sta->addr, trans_id);
}

static void bgscan_learn_add_neighbor(struct bgscan_learn_bss *bss,
				      const u8 *bssid)
{
	u8 *n;

	if (os_memcmp(bss->bssid, bssid, ETH_ALEN) == 0)
		return;
	if (bssid_in_array(bss->neigh, bss->num_neigh, bssid))
		return;

	n = os_realloc_array(bss->neigh, bss->num_neigh + 1, ETH_ALEN);
	if (n == NULL)
		return;

	os_memcpy(n + bss->num_neigh * ETH_ALEN, bssid, ETH_ALEN);
	bss->neigh = n;
	bss->num_neigh++;
}

static void int_array_concat(int **res, const int *a)
{
	int reslen, alen, i;
	int *n;

	reslen = int_array_len(*res);
	alen = int_array_len(a);

	n = os_realloc_array(*res, reslen + alen + 1, sizeof(int));
	if (n == NULL) {
		os_free(*res);
		*res = NULL;
		return;
	}
	for (i = 0; i <= alen; i++)
		n[reslen + i] = a[i];
	*res = n;
}

/**
 * Increase the usage counter for given parent/ifname combination.
 * If create is set, then this iface is added to the global list.
 * Returns
 * 	-1 on error
 * 	0 if iface is not in list
 * 	1 if iface is in list (was there or has been added)
 */
static int hapd_get_dynamic_iface(const char *parent, const char *ifname,
				  int create, struct hostapd_data *hapd)
{
	size_t i;
	struct hostapd_dynamic_iface *j = NULL, **tmp;
	struct hapd_interfaces *hapd_global = hapd->iface->interfaces;

	if (!parent)
		parent = "";

	for (i = 0; i < hapd_global->count_dynamic; i++) {
		j = hapd_global->dynamic_iface[i];
		if (os_strncmp(j->iface, ifname, sizeof(j->iface)) == 0 &&
		    os_strncmp(j->parent, parent, sizeof(j->parent)) == 0)
			break;
	}
	if (i < hapd_global->count_dynamic) {
		j->usage++;
		return 1;
	}

	/* new entry required */
	if (!create)
		return 0;

	j = os_zalloc(sizeof(*j));
	if (!j)
		return -1;
	os_strlcpy(j->iface, ifname, sizeof(j->iface));
	os_strlcpy(j->parent, parent, sizeof(j->parent));

	tmp = os_realloc_array(hapd_global->dynamic_iface, i + 1,
			       sizeof(*hapd_global->dynamic_iface));
	if (!tmp) {
		wpa_printf(MSG_ERROR, "VLAN: Failed to allocate memory in %s",
			   __func__);
		return -1;
	}
	hapd_global->count_dynamic++;
	hapd_global->dynamic_iface = tmp;
	hapd_global->dynamic_iface[i] = j;

	return 1;
}

static void add_alt_name_dns(struct http_ctx *ctx, struct http_cert *cert,
			     ASN1_STRING *name)
{
	char *buf;
	char **n;

	buf = NULL;
	if (ASN1_STRING_to_UTF8((unsigned char **) &buf, name) < 0)
		return;

	n = os_realloc_array(cert->dnsname, cert->num_dnsname + 1,
			     sizeof(char *));
	if (n == NULL)
		return;

	cert->dnsname = n;
	n[cert->num_dnsname] = buf;
	cert->num_dnsname++;
}

int eloop_register_signal(int sig, eloop_signal_handler handler,
			  void *user_data)
{
	struct eloop_signal *tmp;

	tmp = os_realloc_array(eloop.signals, eloop.signal_count + 1,
			       sizeof(struct eloop_signal));
	if (tmp == NULL)
		return -1;

	tmp[eloop.signal_count].sig = sig;
	tmp[eloop.signal_count].user_data = user_data;
	tmp[eloop.signal_count].handler = handler;
	tmp[eloop.signal_count].signaled = 0;
	eloop.signal_count++;
	eloop.signals = tmp;
	signal(sig, eloop_handle_signal);

	return 0;
}