Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Possibly related to #7543?
This appears to be a long-standing memory corruption bug when deleting a playlist entry.
An example that reproduces the original issue under ASAN:
Just in case I'm wrong, I wanted someone else to look at this and make sure it's right. My thinking on this is:
memmove()
here is being used to take the memory for all the playlist entries (minus one), and move it all to the left, so that the second entry becomes the first, etc., and there is now an extra space at the end of the list. memmove takes a source, dest and size. In this case:playlist->entries + idx + 1
, the entry right after the selected oneplaylist->entries + idx
, the location of the selected entry(playlist->size - idx) * sizeof(struct playlist_entry)
, the number of bytes for every playlist item (including the one to delete)In this case, it tries to move
size
entries (all 100) up one, starting at the top entry plus one. This means that it is wrongly reading one entry's worth of memory past the end of the array.My change basically makes it read the number of entries minus one from the starting point and moves them up, since the idea is that we're deleting one and need to make room for it.