From fd9b3b22603c6fe8410d6809a206ab1534b25dc4 Mon Sep 17 00:00:00 2001 From: Eric Haszlakiewicz Date: Sat, 8 Jul 2017 19:04:35 -0700 Subject: [PATCH] Issue #332: fix a long-standing bug in array_list_put_idx() where it would attempt to free previously free'd entries due to not checking the current array length. Add a test that triggers the problem to ensure it stays fixed. --- arraylist.c | 3 ++- tests/test1.c | 13 +++++++++++++ 2 files changed, 15 insertions(+), 1 deletion(-) diff --git a/arraylist.c b/arraylist.c index e859dfd052..8439cc2df0 100644 --- a/arraylist.c +++ b/arraylist.c @@ -96,7 +96,8 @@ array_list_put_idx(struct array_list *arr, size_t idx, void *data) { if (idx > SIZE_T_MAX - 1 ) return -1; if(array_list_expand_internal(arr, idx+1)) return -1; - if(arr->array[idx]) arr->free_fn(arr->array[idx]); + if(idx < arr->length && arr->array[idx]) + arr->free_fn(arr->array[idx]); arr->array[idx] = data; if(arr->length <= idx) arr->length = idx + 1; return 0; diff --git a/tests/test1.c b/tests/test1.c index a53c4ce92a..3ddaf72036 100644 --- a/tests/test1.c +++ b/tests/test1.c @@ -120,6 +120,19 @@ void test_array_del_idx() (int)(orig_array_len + 1), rc, json_object_to_json_string(my_array)); json_object_put(my_array); + + /* Delete some array indexes, then add more */ + my_array = make_array(); + rc = json_object_array_del_idx(my_array, 0, orig_array_len - 1); + printf("after del_idx(0,%d)=%d, my_array.to_string()=%s\n", + (int)(orig_array_len - 1), rc, json_object_to_json_string(my_array)); + json_object_array_add(my_array, json_object_new_string("s1")); + json_object_array_add(my_array, json_object_new_string("s2")); + json_object_array_add(my_array, json_object_new_string("s3")); + + printf("after adding more entries, my_array.to_string()=%s\n", + json_object_to_json_string(my_array)); + json_object_put(my_array); } int main(int argc, char **argv)