diff --git a/m-array.h b/m-array.h index 7f0fd59b..abcc41b9 100644 --- a/m-array.h +++ b/m-array.h @@ -553,7 +553,7 @@ M_DO_MOVE (oplist, *dest, v->ptr[i]); \ else \ M_CALL_CLEAR(oplist, v->ptr[i]); \ - memmove(&v->ptr[i], &v->ptr[i+1], sizeof(type)*(v->size - i) ); \ + memmove(&v->ptr[i], &v->ptr[i+1], sizeof(type)*(v->size-1-i)); \ v->size--; \ M_ARRA4_CONTRACT(v); \ } \ diff --git a/tests/test-marray.c b/tests/test-marray.c index e7fb3c18..1f17637d 100644 --- a/tests/test-marray.c +++ b/tests/test-marray.c @@ -363,6 +363,21 @@ static void test_double(void) assert (*i == ref); ref += 1.0; } + // Test of buffer overflow (with address sanitizer) + // _init_set provides an allocated buffer of the exact needed size + ArrayDouble tab1; + array_double_init_set(tab1, tab); + array_double_pop_at(NULL, tab1, 0); + array_double_clear(tab1); + array_double_init_set(tab1, tab); + array_double_insert_v(tab1, 0, 2); + array_double_clear(tab1); + array_double_init_set(tab1, tab); + array_double_remove_v(tab1, 0, 1); + array_double_clear(tab1); + array_double_init_set(tab1, tab); + array_double_push_at(tab1, 0, 2.); + array_double_clear(tab1); } assert( array_double_empty_p(g_array));