ldb_msg: remove_element() checks element array bounds

Previously we half-heartedly checked one end.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

diff --git a/lib/ldb/common/ldb_msg.c b/lib/ldb/common/ldb_msg.c
index b51e4b1059ea7b26f6cf8699fa7d570076e2f868..2346e66ec39d8eab0b39693f782342402ce11c1f 100644 (file)
--- a/lib/ldb/common/ldb_msg.c
+++ b/lib/ldb/common/ldb_msg.c
@@ -1222,14 +1222,14 @@ int ldb_msg_copy_attr(struct ldb_message *msg, const char *attr, const char *rep
 void ldb_msg_remove_element(struct ldb_message *msg, struct ldb_message_element *el)
 {
        ptrdiff_t n = (el - msg->elements);
-       if (n >= msg->num_elements) {
-               /* should we abort() here? */
+       if (n >= msg->num_elements || n < 0) {
+               /* the element is not in the list. the caller is crazy. */
                return;
        }
-       if (n != msg->num_elements-1) {
-               memmove(el, el+1, ((msg->num_elements-1) - n)*sizeof(*el));
-       }
        msg->num_elements--;
+       if (n != msg->num_elements) {
+               memmove(el, el+1, (msg->num_elements - n)*sizeof(*el));
+       }
 }