From 89e5feacfe1d74583b1c6cbf218841368b1a20bd Mon Sep 17 00:00:00 2001
From: Eric Wong <normalperson@yhbt.net>
Date: Sun, 12 Oct 2008 23:08:57 -0700
Subject: {dir,song}vec: fix off-by-one errors in {dir,song}vec_delete

Found by Valgrind while looking for another bug...

Hmm.. I should really just make this code generic since
they're duplicated...
---
 src/dirvec.c  | 17 +++++++++--------
 src/songvec.c | 17 +++++++++--------
 2 files changed, 18 insertions(+), 16 deletions(-)

diff --git a/src/dirvec.c b/src/dirvec.c
index 14534d05e..cb695ac5d 100644
--- a/src/dirvec.c
+++ b/src/dirvec.c
@@ -36,28 +36,29 @@ struct directory *dirvec_find(const struct dirvec *dv, const char *path)
 
 int dirvec_delete(struct dirvec *dv, struct directory *del)
 {
-	int i;
+	size_t i;
 
 	pthread_mutex_lock(&nr_lock);
-	for (i = dv->nr; --i >= 0; ) {
+	for (i = 0; i < dv->nr; ++i) {
 		if (dv->base[i] != del)
 			continue;
 		/* we _don't_ call directory_free() here */
 		if (!--dv->nr) {
-			pthread_mutex_unlock(&nr_lock);
 			free(dv->base);
 			dv->base = NULL;
-			return i;
 		} else {
-			memmove(&dv->base[i], &dv->base[i + 1],
-				(dv->nr - i + 1) * sizeof(struct directory *));
+			if (i < dv->nr)
+				memmove(&dv->base[i], &dv->base[i + 1],
+					(dv->nr - i) *
+					sizeof(struct directory *));
 			dv->base = xrealloc(dv->base, dv_size(dv));
 		}
-		break;
+		pthread_mutex_unlock(&nr_lock);
+		return i;
 	}
 	pthread_mutex_unlock(&nr_lock);
 
-	return i;
+	return -1; /* not found */
 }
 
 void dirvec_add(struct dirvec *dv, struct directory *add)
diff --git a/src/songvec.c b/src/songvec.c
index c15b99074..613c448cf 100644
--- a/src/songvec.c
+++ b/src/songvec.c
@@ -35,28 +35,29 @@ struct mpd_song *songvec_find(const struct songvec *sv, const char *url)
 
 int songvec_delete(struct songvec *sv, const struct mpd_song *del)
 {
-	int i;
+	size_t i;
 
 	pthread_mutex_lock(&nr_lock);
-	for (i = sv->nr; --i >= 0; ) {
+	for (i = 0; i < sv->nr; ++i) {
 		if (sv->base[i] != del)
 			continue;
 		/* we _don't_ call song_free() here */
 		if (!--sv->nr) {
-			pthread_mutex_unlock(&nr_lock);
 			free(sv->base);
 			sv->base = NULL;
-			return i;
 		} else {
-			memmove(&sv->base[i], &sv->base[i + 1],
-				(sv->nr - i + 1) * sizeof(struct mpd_song *));
+			if (i < sv->nr)
+				memmove(&sv->base[i], &sv->base[i + 1],
+					(sv->nr - i) *
+					sizeof(struct mpd_song *));
 			sv->base = xrealloc(sv->base, sv_size(sv));
 		}
-		break;
+		pthread_mutex_unlock(&nr_lock);
+		return i;
 	}
 	pthread_mutex_unlock(&nr_lock);
 
-	return i;
+	return -1; /* not found */
 }
 
 void songvec_add(struct songvec *sv, struct mpd_song *add)
-- 
cgit v1.2.3