From 5a27c08dd3b2998f5236a1efc4e090e204730abb Mon Sep 17 00:00:00 2001 From: Florian Forster Date: Mon, 25 Dec 2023 22:57:10 +0100 Subject: [PATCH] src/daemon/metric.c: Fix memory corruption in `label_set_delete`. The size parameter passed to `memmove` was in number of pairs, not bytes. --- src/daemon/metric.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/daemon/metric.c b/src/daemon/metric.c index 276f3e50b..558d5b442 100644 --- a/src/daemon/metric.c +++ b/src/daemon/metric.c @@ -151,9 +151,10 @@ static int label_set_delete(label_set_t *labels, label_pair_t *elem) { free(elem->name); free(elem->value); - if (index != (labels->num - 1)) { + size_t pairs_to_move = labels->num - (index + 1); + if (pairs_to_move != 0) { memmove(labels->ptr + index, labels->ptr + (index + 1), - labels->num - (index + 1)); + sizeof(*labels->ptr) * pairs_to_move); } labels->num--; -- 2.47.2