diff options
author | Michael Drake <michael.drake@codethink.co.uk> | 2017-06-27 10:50:06 +0100 |
---|---|---|
committer | Michael Drake <michael.drake@codethink.co.uk> | 2017-06-27 10:50:06 +0100 |
commit | cb0f7f373f55455d07f349f589ce3684d2fda167 (patch) | |
tree | 2e93769993c10188228ad6df4b24332854b75006 | |
parent | a0d2da319d3c13549e24ac012c9dbb2b22fdb957 (diff) | |
download | libcss-cb0f7f373f55455d07f349f589ce3684d2fda167.tar.gz libcss-cb0f7f373f55455d07f349f589ce3684d2fda167.tar.bz2 |
Fix: Read beyond allocated memory when removing sheet from selection context.
Thanks to 'effin' on #netsurf.
-rw-r--r-- | src/select/select.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/src/select/select.c b/src/select/select.c index f1c3637..580c29e 100644 --- a/src/select/select.c +++ b/src/select/select.c @@ -388,11 +388,11 @@ css_error css_select_ctx_remove_sheet(css_select_ctx *ctx, if (index == ctx->n_sheets) return CSS_INVALID; + ctx->n_sheets--; + memmove(&ctx->sheets[index], &ctx->sheets[index + 1], (ctx->n_sheets - index) * sizeof(css_select_sheet)); - ctx->n_sheets--; - return CSS_OK; } |