Proposals / #612

SBmpAllocLoadImage output slot holds an allocated void pointer

applied · by Commit-Will · submitted 2026-11-01, applied 2026-11-01

Ghidra v1797 · 3bccb89

Stack[0xc] ppOutputBuf points to a buffer pointer, not an undefined4 scalar. It is initialized NULL at 006c6e7e. The allocator-callback branch stores its void* result at 006c6f81; the fallback stores SMemAlloc's void* at 006c6f96. The stored value is reloaded at 006c6f9b, tested for NULL, and passed as SBmpDecodeImage's pixel destination at 006c6fa8. The callback definition already returns void* and is unchanged. Retype only ppOutputBuf to void**, preserving name, storage, all other arguments, return and __stdcall. Full 399-byte body and every assignment/use checked, with zero incoming static xrefs. API-contract metadata only, no runtime-use/impact claim. No verified Mac counterpart for this allocator entry.

Changes 1, applied together

1. Retype variable win 0x006c6e70 Stack[0xc]

   typeundefined4 *→void **