fix out-of-bounds read in cx_array_insert_sorted_impl()

Sun, 30 Nov 2025 15:06:02 +0100

author
Mike Becker <universe@uap-core.de>
date
Sun, 30 Nov 2025 15:06:02 +0100
changeset 1531
3ee5a5c7823a
parent 1530
77cb6540d9d8
child 1532
313fd460d264

fix out-of-bounds read in cx_array_insert_sorted_impl()

src/array_list.c file | annotate | diff | comparison | revisions
--- a/src/array_list.c	Sun Nov 30 15:05:21 2025 +0100
+++ b/src/array_list.c	Sun Nov 30 15:06:02 2025 +0100
@@ -520,7 +520,7 @@
                 size_t copy_len = 1, skip_len = 0;
                 {
                     const char *left_src = src;
-                    while (si + copy_len < elem_count) {
+                    while (si + copy_len + skip_len < elem_count) {
                         const char *right_src = left_src + elem_size;
                         int d = cmp_func(left_src,  right_src);
                         if (d < 0) {

mercurial