Skip to content

Commit

Permalink
lib: Fix heap overflow in T_arr_trim()
Browse files Browse the repository at this point in the history
Incorrect element size was used for the memcpy(), and testing didn't
catch this when I implemented it. Tests now make this case obvious with
ASAN.
  • Loading branch information
vkoskiv committed Jan 8, 2024
1 parent f87d7e2 commit b18ba99
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion src/common/dyn_array.h
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,7 @@ static inline size_t grow_x_2(size_t capacity, size_t elem_size) {
static inline void CR_UNUSED T##_arr_trim(struct T##_arr *a) { \
if (!a || a->count >= a->capacity) return; \
T *new = malloc(a->count * sizeof(*a)); \
memcpy(new, a->items, a->count * sizeof(*a)); \
memcpy(new, a->items, a->count * sizeof(*new)); \
free(a->items); \
a->items = new; \
a->capacity = a->count; \
Expand Down

0 comments on commit b18ba99

Please sign in to comment.