Fix some memory corruption bugs in the dynamic list resizing code.
This commit is contained in:
parent
ad6f784731
commit
372e355a73
|
@ -55,14 +55,15 @@ static int do_realloc2(struct csxml* ctx, struct csxml_list* list)
|
||||||
{
|
{
|
||||||
size_t i, newlen = list->size ? (list->size << 1) : 4;
|
size_t i, newlen = list->size ? (list->size << 1) : 4;
|
||||||
struct csxml_buf* n = realloc(list->data, newlen * sizeof(struct csxml_buf));
|
struct csxml_buf* n = realloc(list->data, newlen * sizeof(struct csxml_buf));
|
||||||
|
|
||||||
if(!n) {
|
if(!n) {
|
||||||
ctx->outOfMemory(ctx, newlen * sizeof(struct csxml_buf));
|
ctx->outOfMemory(ctx, newlen * sizeof(struct csxml_buf));
|
||||||
return -1;
|
return -1;
|
||||||
}
|
}
|
||||||
|
|
||||||
memset(n + list->size * sizeof(struct csxml_buf), 0, newlen * sizeof(struct csxml_buf));
|
memset(n + list->size, 0, (newlen - list->size) * sizeof(struct csxml_buf));
|
||||||
for(i = 0; i < newlen; ++i) {
|
for(i = list->size; i < newlen; ++i) {
|
||||||
if(buffer_init(ctx, n + list->size + i)) return -1;
|
if(buffer_init(ctx, n + i)) return -1;
|
||||||
}
|
}
|
||||||
|
|
||||||
list->size = newlen;
|
list->size = newlen;
|
||||||
|
|
Loading…
Reference in New Issue