Fix out-of-bounds memory write in KeyAddrEventQueue

This change prevents `KeyAddrEventQueue::remove()` from shifting values in
memory out of bounds of its arrays if `shift()` is called on an empty queue.  It
also adds a check to be sure that the entry removed is in the queue.

Signed-off-by: Michael Richters <gedankenexperimenter@gmail.com>
pull/1107/head
Michael Richters 3 years ago
parent 4480b08b2d
commit c1bb8b2545
No known key found for this signature in database
GPG Key ID: 1288FD13E4EEF0C0

@ -103,6 +103,8 @@ class KeyAddrEventQueue {
// rather than using a ring buffer because we expect it will be called much
// less often than the queue is searched via a for loop.
void remove(uint8_t n = 0) {
if (n >= length_ || length_ == 0)
return;
// assert(length > n);
--length_;
for (uint8_t i{n}; i < length_; ++i) {

Loading…
Cancel
Save