Skip to content

Commit

Permalink
[pmc] rpa: fix invalid read in delete_keyed_int, off by one
Browse files Browse the repository at this point in the history
with (1,9,10) and key=1 we read one too far.
repro:
  valgrind ./parrot_old -t20 t/compilers/pge/p5regex/p5rx.t
  • Loading branch information
Reini Urban committed Dec 2, 2014
1 parent bd63ea7 commit 2c49485
Showing 1 changed file with 1 addition and 2 deletions.
3 changes: 1 addition & 2 deletions src/pmc/resizablepmcarray.pmc
Expand Up @@ -531,8 +531,7 @@ Delete the element at index C<key> and shift the rest to the left.
}
else {
PMC ** const off = &data[offset+key];
memmove(off, off + 1,
(size - key) * sizeof (PMC *));
memmove(off, off + 1, (size - key - 1) * sizeof (PMC *));
}
#else
for (i = key + offset; i < size - 1; ++i)
Expand Down

0 comments on commit 2c49485

Please sign in to comment.