Jelajahi Sumber

libobs/util: Actually fix use-after-free in da_insert_new

d040de51bb098a1f72a70cbed850e0b99e999071 was prematurely merged, this
should actually do the job as requested.
Lain 2 tahun lalu
induk
melakukan
9178ec6a8d
1 mengubah file dengan 1 tambahan dan 2 penghapusan
  1. 1 2
      libobs/util/darray.h

+ 1 - 2
libobs/util/darray.h

@@ -269,11 +269,10 @@ static inline void *darray_insert_new(const size_t element_size,
 	if (idx == dst->num)
 		return darray_push_back_new(element_size, dst);
 
+	move_count = dst->num - idx;
 	darray_ensure_capacity(element_size, dst, ++dst->num);
 
 	item = darray_item(element_size, dst, idx);
-
-	move_count = dst->num - idx;
 	memmove(darray_item(element_size, dst, idx + 1), item,
 		move_count * element_size);