[Freeciv-Dev] Re: (PR#14783) bug: worklist_length: Assertion `pwl->length >= 0 && pwl->length < 16' failed.

["Jason Short" <jdorje@xxxxxxxxxxxxxxxxxxxxx>]

<URL: http://bugs.freeciv.org/Ticket/Display.html?id=14783 >

Jason Short wrote:
> <URL: http://bugs.freeciv.org/Ticket/Display.html?id=14783 >
> 
>>[cp.ml.freeciv.dev@xxxxxxxxxxxxxx - Tue Dec 06 01:38:57 2005]:
>>
>>civclient: worklist.c:54: worklist_length: Assertion `pwl->length >= 0
>>&& pwl->length < 16' failed
>>
>>in GTK development client when you add the 16th element to city
>>production list. No problem in 2.0.7.
> 
> 
> Well, the assertion is wrong.  Here is the right assertion.
> 
> However it still crashes inside the GTK client.  I haven't been able to
> track it down.  Can you test it in the SDL client?

And here's the rest of the fix - the bug was a buffer overrun; odd that 
valgrind didn't report it.

-jason

Index: common/worklist.c
===================================================================
--- common/worklist.c   (revision 11312)
+++ common/worklist.c   (working copy)
@@ -51,7 +51,7 @@
 ****************************************************************************/
 int worklist_length(const struct worklist *pwl)
 {
-  assert(pwl->length >= 0 && pwl->length < MAX_LEN_WORKLIST);
+  assert(pwl->length >= 0 && pwl->length <= MAX_LEN_WORKLIST);
   return pwl->length;
 }
 

Index: common/worklist.c
===================================================================
--- common/worklist.c   (revision 11313)
+++ common/worklist.c   (working copy)
@@ -167,7 +167,7 @@
   /* move all active values down an index to get room for new id
    * move from [idx .. len - 1] to [idx + 1 .. len].  Any entries at the
    * end are simply lost. */
-  for (i = new_len - 1; i >= idx; i--) {
+  for (i = new_len - 2; i >= idx; i--) {
     pwl->entries[i + 1] = pwl->entries[i];
   }