rarias/ovni
rarias/ovni
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Fix buffer overflow in sort_replace()

Browse Source 
The access to the array was done before the out of bound check.
This commit is contained in:
Rodrigo Arias 2023-04-24 11:47:46 +02:00
parent 3b51902713
commit a8944b3763
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/emu/sort.c
View File

@ -50,7 +50,7 @@ sort_replace(int64_t *arr, int64_t n, int64_t old, int64_t new)
;
/* Copy middle section replacing old */
for (; arr[i + 1] <= new && i < n - 1; i++)
for (; i < n - 1 && arr[i + 1] <= new; i++)
arr[i] = arr[i + 1];
/* Place new */
@ -63,7 +63,7 @@ sort_replace(int64_t *arr, int64_t n, int64_t old, int64_t new)
;
/* Shift right to replace old */
for (; arr[i - 1] > new && i > 0; i--)
for (; i > 0 && arr[i - 1] > new; i--)
arr[i] = arr[i - 1];
/* Invariant: Either i == 0 or arr[i] <= new