mirror/json-c
1
0
Fork 0
mirror of https://github.com/json-c/json-c.git synced 2026-03-18 04:29:07 +08:00
Code Issues Packages Projects Releases Wiki Activity

Issue #332: fix a long-standing bug in array_list_put_idx() where it would attempt to free previously free'd entries due to not checking the current array length.

Browse Source 
Add a test that triggers the problem to ensure it stays fixed.
This commit is contained in:
Eric Haszlakiewicz
2017-07-08 19:04:35 -07:00
parent 7fd74fc7a3
commit fd9b3b2260
2 changed files with 15 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
arraylist.c
View File

@@ -96,7 +96,8 @@ array_list_put_idx(struct array_list *arr, size_t idx, void *data)
{
if (idx > SIZE_T_MAX - 1 ) return -1;
if(array_list_expand_internal(arr, idx+1)) return -1;
if(arr->array[idx]) arr->free_fn(arr->array[idx]);
if(idx < arr->length && arr->array[idx])
arr->free_fn(arr->array[idx]);
arr->array[idx] = data;
if(arr->length <= idx) arr->length = idx + 1;
return 0;

13
tests/test1.c
View File

@@ -120,6 +120,19 @@ void test_array_del_idx()
(int)(orig_array_len + 1), rc, json_object_to_json_string(my_array));
json_object_put(my_array);
/* Delete some array indexes, then add more */
my_array = make_array();
rc = json_object_array_del_idx(my_array, 0, orig_array_len - 1);
printf("after del_idx(0,%d)=%d, my_array.to_string()=%s\n",
(int)(orig_array_len - 1), rc, json_object_to_json_string(my_array));
json_object_array_add(my_array, json_object_new_string("s1"));
json_object_array_add(my_array, json_object_new_string("s2"));
json_object_array_add(my_array, json_object_new_string("s3"));
printf("after adding more entries, my_array.to_string()=%s\n",
json_object_to_json_string(my_array));
json_object_put(my_array);
}
int main(int argc, char **argv)