Browse Source

libobs/util: Fix use-after-free in darray_insert_new

After the array is allocated in `darray_ensure_capacity`, the pointer
`item` is invalid.

(cherry picked from commit d040de51bb098a1f72a70cbed850e0b99e999071)
Norihiro Kamae 2 years ago
parent
commit
e1e0d944fc
1 changed files with 2 additions and 1 deletions
  1. 2 1
      libobs/util/darray.h

+ 2 - 1
libobs/util/darray.h

@@ -269,10 +269,11 @@ static inline void *darray_insert_new(const size_t element_size,
 	if (idx == dst->num)
 		return darray_push_back_new(element_size, dst);
 
+	darray_ensure_capacity(element_size, dst, ++dst->num);
+
 	item = darray_item(element_size, dst, idx);
 
 	move_count = dst->num - idx;
-	darray_ensure_capacity(element_size, dst, ++dst->num);
 	memmove(darray_item(element_size, dst, idx + 1), item,
 		move_count * element_size);