From d056d8e577b43740180f1a7d2295f77c9149d8a1 Mon Sep 17 00:00:00 2001

From: Elliott Sales de Andrade <quantum.analyst@gmail.com>

Date: Tue, 28 Nov 2017 05:03:40 -0500

Subject: [PATCH] Fix array allocation in Index_GetLeaves.

When filling the array, it iterates through `nDimension` elements, but

only allocates `nLeafSizes[k]` entries. This causes out-of-bounds access

when dimensions are greater than leafs.

---

 src/capi/sidx_api.cc | 4 ++--

 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/capi/sidx_api.cc b/src/capi/sidx_api.cc

index af3bc82..b33ba3f 100644

--- a/src/capi/sidx_api.cc

+++ b/src/capi/sidx_api.cc

@@ -1693,8 +1693,8 @@ SIDX_C_DLL RTError Index_GetLeaves(	IndexH index,

 			(*nLeafSizes)[k] = (uint32_t)ids.size();

 			(*nLeafChildIDs)[k] = (int64_t*) malloc( (*nLeafSizes)[k] * sizeof(int64_t));

-			(*pppdMin)[k] = (double*) malloc ( (*nLeafSizes)[k] *  sizeof(double));

-			(*pppdMax)[k] = (double*) malloc ( (*nLeafSizes)[k] *  sizeof(double));

+			(*pppdMin)[k] = (double*) malloc (*nDimension * sizeof(double));

+			(*pppdMax)[k] = (double*) malloc (*nDimension * sizeof(double));

 			for (uint32_t i=0; i< *nDimension; ++i) {

 				(*pppdMin)[k][i] = b->getLow(i);

 				(*pppdMax)[k][i] = b->getHigh(i);