fix possibe buffer-off-by one

diff --git a/src/ngircd/array.c b/src/ngircd/array.c
index bc28d042fdd4e65d8aba29b5e1760a2f31137bbc..1342c670060db94242267c19c6c32a5eca5f4a94 100644 (file)
--- a/src/ngircd/array.c
+++ b/src/ngircd/array.c
@@ -12,7 +12,7 @@
 
 #include "array.h"
 
 
 #include "array.h"
 

-static char UNUSED id[] = "$Id: array.c,v 1.12 2006/09/30 21:49:46 fw Exp $";
+static char UNUSED id[] = "$Id: array.c,v 1.13 2006/12/17 22:52:43 fw Exp $";

 
 #include <assert.h>
 
 
 #include <assert.h>
 


@@ -247,19 +247,21 @@ void *
 array_get(array * a, size_t membersize, size_t pos)
 {
        size_t totalsize;
 array_get(array * a, size_t membersize, size_t pos)
 {
        size_t totalsize;

+       size_t posplus1 = pos + 1;

 
        assert(membersize > 0);
        assert(a != NULL);
 
 
        assert(membersize > 0);
        assert(a != NULL);
 

-       if (array_UNUSABLE(a))
+       if (!posplus1 || array_UNUSABLE(a))

                return NULL;
 
                return NULL;
 

-       if (!safemult_sizet(pos, membersize, &totalsize))
+       if (!safemult_sizet(posplus1, membersize, &totalsize))

                return NULL;
 
        if (a->allocated < totalsize)
                return NULL;
 
                return NULL;
 
        if (a->allocated < totalsize)
                return NULL;
 

+       totalsize = pos * membersize;

        return a->mem + totalsize;
 }
 
        return a->mem + totalsize;
 }