summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMichael Drake <michael.drake@codethink.co.uk>2017-06-27 10:50:06 +0100
committerMichael Drake <michael.drake@codethink.co.uk>2017-06-27 10:50:06 +0100
commitcb0f7f373f55455d07f349f589ce3684d2fda167 (patch)
tree2e93769993c10188228ad6df4b24332854b75006
parenta0d2da319d3c13549e24ac012c9dbb2b22fdb957 (diff)
downloadlibcss-cb0f7f373f55455d07f349f589ce3684d2fda167.tar.gz
libcss-cb0f7f373f55455d07f349f589ce3684d2fda167.tar.bz2
Fix: Read beyond allocated memory when removing sheet from selection context.
Thanks to 'effin' on #netsurf.
-rw-r--r--src/select/select.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/src/select/select.c b/src/select/select.c
index f1c3637..580c29e 100644
--- a/src/select/select.c
+++ b/src/select/select.c
@@ -388,11 +388,11 @@ css_error css_select_ctx_remove_sheet(css_select_ctx *ctx,
if (index == ctx->n_sheets)
return CSS_INVALID;
+ ctx->n_sheets--;
+
memmove(&ctx->sheets[index], &ctx->sheets[index + 1],
(ctx->n_sheets - index) * sizeof(css_select_sheet));
- ctx->n_sheets--;
-
return CSS_OK;
}