_dfs_Add() uses a strange way to realloc the jn->referral_list array. There's a temporary read of unrelated or non-existing memory, but we directly overwrite the wrong initialized values again. This was reported by Arjun Basnet with Securin Labs.