From: Mathias Froehlich <Mathias.Froehlich@web.de>
Date: Sun, 26 Feb 2012 12:14:39 +0000 (+0100)
Subject: hla: Fix buffer overrun in SGMath vector types.
X-Git-Url: https://git.mxchange.org/?a=commitdiff_plain;h=a563cfd0f2a5e68ad0eab1a371b141fab4ddd59e;p=simgear.git

hla: Fix buffer overrun in SGMath vector types.
---

diff --git a/simgear/hla/HLAArrayDataElement.hxx b/simgear/hla/HLAArrayDataElement.hxx
index de3c1d0a..8f510be5 100644
--- a/simgear/hla/HLAArrayDataElement.hxx
+++ b/simgear/hla/HLAArrayDataElement.hxx
@@ -214,7 +214,7 @@ public:
 
     virtual bool setNumElements(unsigned count)
     {
-        for (unsigned i = 2; i < count; ++i)
+        for (unsigned i = count; i < 2; ++i)
             _value[i] = 0;
         return true;
     }
@@ -306,7 +306,7 @@ public:
 
     virtual bool setNumElements(unsigned count)
     {
-        for (unsigned i = 3; i < count; ++i)
+        for (unsigned i = count; i < 3; ++i)
             _value[i] = 0;
         return true;
     }
@@ -398,7 +398,7 @@ public:
 
     virtual bool setNumElements(unsigned count)
     {
-        for (unsigned i = 4; i < count; ++i)
+        for (unsigned i = count; i < 4; ++i)
             _value[i] = 0;
         return true;
     }
@@ -490,7 +490,7 @@ public:
 
     virtual bool setNumElements(unsigned count)
     {
-        for (unsigned i = 4; i < count; ++i)
+        for (unsigned i = count; i < 4; ++i)
             _value[i] = 0;
         return true;
     }