tree 65fa85c661c9f714e2e46d277ec4c5085947effd
parent 75057c875743c4ad9989e124b0165e663894ebb3
author Brad Bishop <bradleyb@fuzziesquirrel.com> 1628020903 -0400
committer Brad Bishop <bradleyb@fuzziesquirrel.com> 1628282450 -0400

libmapper: fix logic bug

sarraylen returns the number of strings and does not include the
trailing null pointer.  This results in sarraydup creating arrays of
strings where the array is not null pointer terminated (the strings
themselves _are_ \0 terminated), which in turn causes random data to be
passed to free.

The bug was found using static analysis and inspection would indicate
exposure only exists on error and shutdown paths, which might be a hint
as to how this has been lurking for as long as it has.

Change-Id: Ie5e5b6cdfb7832c84037ff039b41082fc7d20b61
Signed-off-by: Brad Bishop <bradleyb@fuzziesquirrel.com>