{dir,song}vec: fix off-by-one errors in {dir,song}vec_delete

Found by Valgrind while looking for another bug...

Hmm.. I should really just make this code generic since
they're duplicated...

2 files changed, 9 insertions, 10 deletions

diff --git a/src/dirvec.c b/src/dirvec.c
index 72b1c0084..98cb9e7ad 100644
--- a/src/dirvec.c
+++ b/src/dirvec.c
@@ -37,9 +37,9 @@ struct directory *dirvec_find(const struct dirvec *dv, const char *path)
 
 int dirvec_delete(struct dirvec *dv, struct directory *del)
 {
-	int i;
+	size_t i;
 
-	for (i = dv->nr; --i >= 0; ) {
+	for (i = 0; i < dv->nr; ++i) {
 		if (dv->base[i] != del)
 			continue;
 		/* we _don't_ call directory_free() here */
@@ -48,7 +48,7 @@ int dirvec_delete(struct dirvec *dv, struct directory *del)
 			dv->base = NULL;
 		} else {
 			memmove(&dv->base[i], &dv->base[i + 1],
-				(dv->nr - i + 1) * sizeof(struct directory *));
+				(dv->nr - i) * sizeof(struct directory *));
 			dv->base = xrealloc(dv->base, dv_size(dv));
 		}
 		return i;
diff --git a/src/songvec.c b/src/songvec.c
index 80954643e..a62c6e671 100644
--- a/src/songvec.c
+++ b/src/songvec.c
@@ -47,28 +47,27 @@ songvec_find(const struct songvec *sv, const char *url)
 int
 songvec_delete(struct songvec *sv, const struct song *del)
 {
-	int i;
+	size_t i;
 
 	pthread_mutex_lock(&nr_lock);
-	for (i = sv->nr; --i >= 0; ) {
+	for (i = 0; i < sv->nr; ++i) {
 		if (sv->base[i] != del)
 			continue;
 		/* we _don't_ call song_free() here */
 		if (!--sv->nr) {
-			pthread_mutex_unlock(&nr_lock);
 			free(sv->base);
 			sv->base = NULL;
-			return i;
 		} else {
 			memmove(&sv->base[i], &sv->base[i + 1],
-				(sv->nr - i + 1) * sizeof(struct song *));
+				(sv->nr - i) * sizeof(struct song *));
 			sv->base = xrealloc(sv->base, sv_size(sv));
 		}
-		break;
+		pthread_mutex_unlock(&nr_lock);
+		return i;
 	}
 	pthread_mutex_unlock(&nr_lock);
 
-	return i;
+	return -1; /* not found */
 }
 
 void