hla: Fix buffer overrun in SGMath vector types.

diff --git a/simgear/hla/HLAArrayDataElement.hxx b/simgear/hla/HLAArrayDataElement.hxx
index de3c1d0aee945e39b5db77d0e4168795ad808818..8f510be59c63a959a406050f34d41e5c859aa87c 100644 (file)
--- a/simgear/hla/HLAArrayDataElement.hxx
+++ b/simgear/hla/HLAArrayDataElement.hxx
@@ -214,7 +214,7 @@ public:
 
     virtual bool setNumElements(unsigned count)
     {
-        for (unsigned i = 2; i < count; ++i)
+        for (unsigned i = count; i < 2; ++i)
             _value[i] = 0;
         return true;
     }
@@ -306,7 +306,7 @@ public:
 
     virtual bool setNumElements(unsigned count)
     {
-        for (unsigned i = 3; i < count; ++i)
+        for (unsigned i = count; i < 3; ++i)
             _value[i] = 0;
         return true;
     }
@@ -398,7 +398,7 @@ public:
 
     virtual bool setNumElements(unsigned count)
     {
-        for (unsigned i = 4; i < count; ++i)
+        for (unsigned i = count; i < 4; ++i)
             _value[i] = 0;
         return true;
     }
@@ -490,7 +490,7 @@ public:
 
     virtual bool setNumElements(unsigned count)
     {
-        for (unsigned i = 4; i < count; ++i)
+        for (unsigned i = count; i < 4; ++i)
             _value[i] = 0;
         return true;
     }