[GRASS-SVN] r68001 - grass/trunk/vector/v.net.steiner

[svn_grass at osgeo.org]

Author: marisn
Date: 2016-03-04 15:36:28 -0800 (Fri, 04 Mar 2016)
New Revision: 68001

Modified:
   grass/trunk/vector/v.net.steiner/main.c
Log:
v.net.steiner: fix out of bounds reads and writes

Modified: grass/trunk/vector/v.net.steiner/main.c
===================================================================
--- grass/trunk/vector/v.net.steiner/main.c	2016-03-04 23:07:13 UTC (rev 68000)
+++ grass/trunk/vector/v.net.steiner/main.c	2016-03-04 23:36:28 UTC (rev 68001)
@@ -233,9 +233,10 @@
 	else {
 	    scpos = -1;
 	}
-	G_debug(3, "tcpos = %d, scpos = %d\n", tcpos, scpos);
-	G_debug(3, "tcost = %f, scost = %f\n", term_costs[tcpos].cost,
-		sp_costs[scpos].cost);
+	/* Do not access invalid items even for debugging */
+    if (tcpos != -1 && scpos != -1)
+        G_debug(3, "tcost = %f, scost = %f\n", term_costs[tcpos].cost,
+            sp_costs[scpos].cost);
 
 	/* Now we have positions set on lowest costs in each queue or -1 if no more/not used */
 	if (tcpos >= 0 && scpos >= 0) {
@@ -475,11 +476,11 @@
 	testnode[i] = 1;
 
     /* Alloc arrays of costs for nodes, first node at 1 (0 not used) */
-    nodes_costs = (double **)G_malloc((nnodes - 1) * sizeof(double *));
+    nodes_costs = (double **)G_malloc((nnodes) * sizeof(double *));
     for (i = 0; i < nnodes; i++) {
 	nodes_costs[i] =
-	    (double *)G_malloc((nnodes - i - 1) * sizeof(double));
-	for (j = 0; j < nnodes - i - 1; j++)
+	    (double *)G_malloc((nnodes - i) * sizeof(double));
+	for (j = 0; j < nnodes - i; j++)
 	    nodes_costs[i][j] = -1;	/* init, i.e. cost was not calculated yet */
     }