diff options
| author | Kevin Wolf <kwolf@redhat.com> | 2020-06-23 19:55:34 +0200 |
|---|---|---|
| committer | Kevin Wolf <kwolf@redhat.com> | 2020-07-03 09:37:03 +0200 |
| commit | 3dfa23b9eff4315817c1acf59711b8414347de31 (patch) | |
| tree | 5ad03f87cb92d3f7a6da38cee8f9c2c53bdab19e /qapi/qobject-input-visitor.c | |
| parent | c79e243ed67683d6d06692bd7040f7394da178b0 (diff) | |
| download | focaccia-qemu-3dfa23b9eff4315817c1acf59711b8414347de31.tar.gz focaccia-qemu-3dfa23b9eff4315817c1acf59711b8414347de31.zip | |
vvfat: Fix array_remove_slice()
array_remove_slice() calls array_roll() with array->next - 1 as the destination index. This is only correct for count == 1, otherwise we're writing past the end of the array. array->next - count would be correct. However, this is the only place ever calling array_roll(), so this rather complicated operation isn't even necessary. Fix the problem and simplify the code by replacing it with a single memmove() call. array_roll() can now be removed. Reported-by: Nathan Huckleberry <nhuck15@gmail.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> Message-Id: <20200623175534.38286-3-kwolf@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Diffstat (limited to 'qapi/qobject-input-visitor.c')
0 files changed, 0 insertions, 0 deletions