OBS/obs-studio
OBS/obs-studio
1
0
Fork 0
mirror of https://github.com/obsproject/obs-studio.git synced 2024-07-14 23:34:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

libobs/util: Fix use-after-free in darray_insert_new

Browse source 
After the array is allocated in `darray_ensure_capacity`, the pointer
`item` is invalid.
This commit is contained in:
Norihiro Kamae 2023-06-10 02:02:51 +09:00 committed by Lain
parent 2ea47bb65a
commit d040de51bb
1 changed files with 2 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
libobs/util/darray.h
View file

@ -269,10 +269,11 @@ static inline void *darray_insert_new(const size_t element_size,
if (idx == dst->num)
return darray_push_back_new(element_size, dst);
darray_ensure_capacity(element_size, dst, ++dst->num);
item = darray_item(element_size, dst, idx);
move_count = dst->num - idx;
darray_ensure_capacity(element_size, dst, ++dst->num);
memmove(darray_item(element_size, dst, idx + 1), item,
move_count * element_size);