Fix UAF in r->data ptr after realloc

src/camlib.h

@@ -111,7 +111,7 @@ struct PtpRuntime {
 	int session;
 
 	/// @brief Global buffer for data reading and writing
-	/// @note Can grow in size as needed.
+	/// @note This is volatile - it will grow in size (pointer will change) when needed.
     uint8_t *data;
     int data_length;
 

src/transport.c

@@ -81,6 +81,8 @@ int ptpip_read_packet(struct PtpRuntime *r, int of) {
 		if (rc) return rc;
 	}
 
+	h = (struct PtpIpHeader *)(r->data + of);
+
 	while (1) {
 		rc = ptpip_cmd_read(r, r->data + of + read, h->length - read);
 
@@ -246,6 +248,9 @@ int ptpipusb_read_packet(struct PtpRuntime *r, int of) {
 		if (rc) return rc;
 	}
 
+	// Update struct after resize
+	h = (struct PtpBulkContainer *)(r->data + of);
+
 	while (1) {
 		rc = ptpip_cmd_read(r, r->data + of + read, h->length - read);