From: Amos Jeffries <squid3@treenet.co.nz>
Date: Tue, 7 Dec 2010 02:30:31 +0000 (+1300)
Subject: Fix buffer overwrite when pconn idle list is full
X-Git-Tag: take08~55^2~124^2~23
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=4bddcf07e89c9e9e1241799dda72b0c5a08a883b;p=thirdparty%2Fsquid.git

Fix buffer overwrite when pconn idle list is full
---

diff --git a/src/pconn.cc b/src/pconn.cc
index 386ecfb9b5..1c6a2bbf72 100644
--- a/src/pconn.cc
+++ b/src/pconn.cc
@@ -104,7 +104,7 @@ IdleConnList::removeAt(int index)
     // shuffle the remaining entries to fill the new gap.
     for (; index < size_ - 1; index++)
         theList_[index] = theList_[index + 1];
-    theList_[size_] = NULL;
+    theList_[size_-1] = NULL;
 
     if (--size_ == 0) {
         debugs(48, 3, HERE << "deleting " << hashKeyStr(&hash));