Sun, 30 Nov 2025 15:06:02 +0100
fix out-of-bounds read in cx_array_insert_sorted_impl()
| src/array_list.c | file | annotate | diff | comparison | revisions |
--- a/src/array_list.c Sun Nov 30 15:05:21 2025 +0100 +++ b/src/array_list.c Sun Nov 30 15:06:02 2025 +0100 @@ -520,7 +520,7 @@ size_t copy_len = 1, skip_len = 0; { const char *left_src = src; - while (si + copy_len < elem_count) { + while (si + copy_len + skip_len < elem_count) { const char *right_src = left_src + elem_size; int d = cmp_func(left_src, right_src); if (d < 0) {