From 5923956045015076d85c42ecab99bc0d27861eba Mon Sep 17 00:00:00 2001
From: ThorstenB <brehmt@gmail.com>
Date: Mon, 9 Jan 2012 20:21:28 +0100
Subject: [PATCH] #587: don't crash on negative sizes

---
 simgear/nasal/code.c   |  4 ++--
 simgear/nasal/iolib.c  |  2 +-
 simgear/nasal/lib.c    |  6 +++---
 simgear/nasal/nasal.h  |  2 +-
 simgear/nasal/vector.c | 23 ++++++++++++++---------
 5 files changed, 21 insertions(+), 16 deletions(-)

diff --git a/simgear/nasal/code.c b/simgear/nasal/code.c
index e58f7ecb..782509da 100644
--- a/simgear/nasal/code.c
+++ b/simgear/nasal/code.c
@@ -269,7 +269,7 @@ static void setupArgs(naContext ctx, struct Frame* f, naRef* args, int nargs)
     args += c->nOptArgs;
     if(c->needArgVector || nargs > 0) {
         naRef argv = naNewVector(ctx);
-        naVec_setsize(argv, nargs > 0 ? nargs : 0);
+        naVec_setsize(ctx, argv, nargs > 0 ? nargs : 0);
         for(i=0; i<nargs; i++)
             PTR(argv).vec->rec->array[i] = *args++;
         naiHash_newsym(PTR(f->locals).hash, &c->constants[c->restArgSym], &argv);
@@ -349,7 +349,7 @@ static naRef evalCat(naContext ctx, naRef l, naRef r)
     if(IS_VEC(l) && IS_VEC(r)) {
         int i, ls = naVec_size(l), rs = naVec_size(r);
         naRef v = naNewVector(ctx);
-        naVec_setsize(v, ls + rs);
+        naVec_setsize(ctx, v, ls + rs);
         for(i=0; i<ls; i+=1) naVec_set(v, i, naVec_get(l, i));
         for(i=0; i<rs; i+=1) naVec_set(v, i+ls, naVec_get(r, i));
         return v;
diff --git a/simgear/nasal/iolib.c b/simgear/nasal/iolib.c
index b4dbc93d..bbe9004a 100644
--- a/simgear/nasal/iolib.c
+++ b/simgear/nasal/iolib.c
@@ -228,7 +228,7 @@ static naRef f_stat(naContext ctx, naRef me, int argc, naRef* args)
         naRuntimeError(ctx, strerror(errno));
     }
     result = naNewVector(ctx);
-    naVec_setsize(result, 12);
+    naVec_setsize(ctx, result, 12);
 #define FLD(x) naVec_set(result, n++, naNum(s.st_##x));
     FLD(dev);  FLD(ino);  FLD(mode);  FLD(nlink);  FLD(uid);  FLD(gid);
     FLD(rdev); FLD(size); FLD(atime); FLD(mtime);  FLD(ctime);
diff --git a/simgear/nasal/lib.c b/simgear/nasal/lib.c
index 11c8e434..17d5b2c5 100644
--- a/simgear/nasal/lib.c
+++ b/simgear/nasal/lib.c
@@ -56,7 +56,7 @@ static naRef f_pop(naContext c, naRef me, int argc, naRef* args)
 static naRef f_setsize(naContext c, naRef me, int argc, naRef* args)
 {
     if(argc < 2 || !naIsVector(args[0])) ARGERR();
-    naVec_setsize(args[0], (int)naNumValue(args[1]).num);
+    naVec_setsize(c, args[0], (int)naNumValue(args[1]).num);
     return args[0];
 }
 
@@ -74,7 +74,7 @@ static naRef f_subvec(naContext c, naRef me, int argc, naRef* args)
     if(naIsNil(nlen) || len > naVec_size(v) - start)
         len = naVec_size(v) - start;
     result = naNewVector(c);
-    naVec_setsize(result, len);
+    naVec_setsize(c, result, len);
     for(i=0; i<len; i++)
         naVec_set(result, i, naVec_get(v, start + i));
     return result;
@@ -533,7 +533,7 @@ static naRef f_sort(naContext c, naRef me, int argc, naRef* args)
     qsort(sd.recs, sd.n, sizeof(sd.recs[0]),
           (int(*)(const void*,const void*))sortcmp);
     out = naNewVector(c);
-    naVec_setsize(out, sd.n);
+    naVec_setsize(c, out, sd.n);
     for(i=0; i<sd.n; i++)
         PTR(out).vec->rec->array[i] = sd.elems[sd.recs[i].i];
     naFree(sd.recs);
diff --git a/simgear/nasal/nasal.h b/simgear/nasal/nasal.h
index a7741b49..6857013a 100644
--- a/simgear/nasal/nasal.h
+++ b/simgear/nasal/nasal.h
@@ -166,7 +166,7 @@ naRef naVec_get(naRef v, int i);
 void naVec_set(naRef vec, int i, naRef o);
 int naVec_append(naRef vec, naRef o);
 naRef naVec_removelast(naRef vec);
-void naVec_setsize(naRef vec, int sz);
+void naVec_setsize(naContext c, naRef vec, int sz);
 
 // Hash utilities:
 int naHash_size(naRef h);
diff --git a/simgear/nasal/vector.c b/simgear/nasal/vector.c
index df20c138..1a7546ae 100644
--- a/simgear/nasal/vector.c
+++ b/simgear/nasal/vector.c
@@ -69,16 +69,21 @@ int naVec_append(naRef vec, naRef o)
     return 0;
 }
 
-void naVec_setsize(naRef vec, int sz)
+void naVec_setsize(naContext c, naRef vec, int sz)
 {
-    int i;
-    struct VecRec* v = PTR(vec).vec->rec;
-    struct VecRec* nv = naAlloc(sizeof(struct VecRec) + sizeof(naRef) * sz);
-    nv->size = sz;
-    nv->alloced = sz;
-    for(i=0; i<sz; i++)
-        nv->array[i] = (v && i < v->size) ? v->array[i] : naNil();
-    naGC_swapfree((void*)&(PTR(vec).vec->rec), nv);
+    if (sz < 0)
+        naRuntimeError(c, "size cannot be negative");
+    else
+    {
+        int i;
+        struct VecRec* v = PTR(vec).vec->rec;
+        struct VecRec* nv = naAlloc(sizeof(struct VecRec) + sizeof(naRef) * sz);
+        nv->size = sz;
+        nv->alloced = sz;
+        for(i=0; i<sz; i++)
+            nv->array[i] = (v && i < v->size) ? v->array[i] : naNil();
+        naGC_swapfree((void*)&(PTR(vec).vec->rec), nv);
+    }
 }
 
 naRef naVec_removelast(naRef vec)