From d910e58c3af594003b8b6d2b9d2452979d42cd06 Mon Sep 17 00:00:00 2001
From: Syoyo Fujita <syoyo@lighttransport.com>
Date: Thu, 19 Mar 2026 02:38:28 +0900
Subject: [PATCH] Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 tinygltf_json.h | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/tinygltf_json.h b/tinygltf_json.h
index a43fcce..338af82 100644
--- a/tinygltf_json.h
+++ b/tinygltf_json.h
@@ -1077,10 +1077,14 @@ inline tinygltf_json &tinygltf_json::operator[](const char *key) {
     new (nm) tinygltf_json_member();
     size_t klen = strlen(key);
     nm->key = (char *)malloc(klen + 1);
-    if (nm->key) {
-        memcpy(nm->key, key, klen + 1);
-        nm->key_len = klen;
+    if (!nm->key) {
+        /* Roll back insertion on key allocation failure: do not bump
+         * obj_size_, and return the shared null fallback, keeping the
+         * object in a consistent state. */
+        return null_fallback;
     }
+    memcpy(nm->key, key, klen + 1);
+    nm->key_len = klen;
     ++obj_size_;
     return nm->val;
 }