From: Tobias Brunner <tobias@strongswan.org>
Date: Tue, 18 Mar 2014 13:42:44 +0000 (+0100)
Subject: array: Fix removal of elements in the second half of an array
X-Git-Tag: 5.1.3dr1~11
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=11f31ceb6af75c8653ba68d93f5f6c8def1391e0;p=thirdparty%2Fstrongswan.git

array: Fix removal of elements in the second half of an array

Memory beyond the end of the array was moved when array elements in the
second half of an array were removed.

Fixes #548.
---

diff --git a/src/libstrongswan/collections/array.c b/src/libstrongswan/collections/array.c
index 314e8e9165..75efb85bf6 100644
--- a/src/libstrongswan/collections/array.c
+++ b/src/libstrongswan/collections/array.c
@@ -141,7 +141,7 @@ static void remove_tail(array_t *array, int idx)
 	/* move all items after idx one down */
 	memmove(array->data + get_size(array, idx + array->head),
 			array->data + get_size(array, idx + array->head + 1),
-			get_size(array, array->count - idx));
+			get_size(array, array->count - 1 - idx));
 	array->count--;
 	array->tail++;
 }