# HG changeset patch
# User Mike Becker <universe@uap-core.de>
# Date 1764511562 -3600
# Node ID 3ee5a5c7823ac6a270637dec71cd35c207dca924
# Parent  77cb6540d9d8f6f31fa6170a48c84da1ffa8a05c
fix out-of-bounds read in cx_array_insert_sorted_impl()

diff -r 77cb6540d9d8 -r 3ee5a5c7823a src/array_list.c
--- a/src/array_list.c	Sun Nov 30 15:05:21 2025 +0100
+++ b/src/array_list.c	Sun Nov 30 15:06:02 2025 +0100
@@ -520,7 +520,7 @@
                 size_t copy_len = 1, skip_len = 0;
                 {
                     const char *left_src = src;
-                    while (si + copy_len < elem_count) {
+                    while (si + copy_len + skip_len < elem_count) {
                         const char *right_src = left_src + elem_size;
                         int d = cmp_func(left_src,  right_src);
                         if (d < 0) {