Fix heap buffer overflow due to operator precedence

gtk-rs · Jun 6, 2023 · 01a5517 · 01a5517
1 parent f54c9b2
commit 01a5517
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/glib/src/collections/strv.rs b/glib/src/collections/strv.rs
@@ -446,8 +446,10 @@ impl StrV {
         if len == 0 {
             StrV::default()
         } else {
+            // Allocate space for len + 1 pointers, one pointer for each string and a trailing
+            // null pointer.
             let new_ptr =
-                ffi::g_malloc(mem::size_of::<*mut c_char>() * len + 1) as *mut *mut c_char;
+                ffi::g_malloc(mem::size_of::<*mut c_char>() * (len + 1)) as *mut *mut c_char;
 
             // Need to clone every item because we don't own it here
             for i in 0..len {