array: Fix removal of elements in the second half of an array

Memory beyond the end of the array was moved when array elements in the
second half of an array were removed.

Fixes #548.

diff --git a/src/libstrongswan/collections/array.c b/src/libstrongswan/collections/array.c
index 314e8e91654a1bfa5f694252c592bdf02aff3bb5..75efb85bf660fa5ab8573dd24d0be976364d9281 100644 (file)
--- a/src/libstrongswan/collections/array.c
+++ b/src/libstrongswan/collections/array.c
@@ -141,7 +141,7 @@ static void remove_tail(array_t *array, int idx)
        /* move all items after idx one down */
        memmove(array->data + get_size(array, idx + array->head),
                        array->data + get_size(array, idx + array->head + 1),
-                       get_size(array, array->count - idx));
+                       get_size(array, array->count - 1 - idx));
        array->count--;
        array->tail++;
 }