diff options
| author | Dave Camarillo <dave.camarillo@gmail.com> | 2011-09-23 11:56:58 +0100 |
|---|---|---|
| committer | Dave Camarillo <dave.camarillo@gmail.com> | 2011-09-23 13:10:22 +0100 |
| commit | c40394342aecac34fdd36cdb0d80a3722b2bc9a0 (patch) | |
| tree | b251364bba8bd01912e4bc87d97d4a6adc5555cf | |
| parent | 15f4edbfd0a510ec0b106e549412da2cec5e8d31 (diff) | |
| download | libusb-c40394342aecac34fdd36cdb0d80a3722b2bc9a0.tar.gz | |
[enum] fix bad realloc trigger for the unref_list array
* indexes were outgrowing the array before realloc,
resulting in out of bound access and crash.
| -rw-r--r-- | libusb/os/windows_usb.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libusb/os/windows_usb.c b/libusb/os/windows_usb.c index 8157aec..aa13654 100644 --- a/libusb/os/windows_usb.c +++ b/libusb/os/windows_usb.c @@ -1462,7 +1462,7 @@ static int windows_get_device_list(struct libusb_context *ctx, struct discovered windows_device_priv_init(dev); // Keep track of devices that need unref unref_list[unref_cur++] = dev; - if (unref_cur > unref_size) { + if (unref_cur >= unref_size) { unref_size += 64; unref_list = realloc(unref_list, unref_size*sizeof(libusb_device*)); if (unref_list == NULL) { |