tls: fix access to array (out of bounds)

alalek · alalek · commit b8956d0111c1 · 2015-08-21T16:43:15.000+03:00
diff --git a/modules/core/src/system.cpp b/modules/core/src/system.cpp
@@ -1089,9 +1089,10 @@ class TlsStorage
 
         for(size_t i = 0; i < threads.size(); i++)
         {
-            if(threads[i]->slots[slotIdx])
+            std::vector<void*>& thread_slots = threads[i]->slots;
+            if (thread_slots.size() > slotIdx && thread_slots[slotIdx])
             {
-                dataVec.push_back(threads[i]->slots[slotIdx]);
+                dataVec.push_back(thread_slots[slotIdx]);
                 threads[i]->slots[slotIdx] = 0;
             }
         }

Original file line number	Diff line number	Diff line change
`@@ -1089,9 +1089,10 @@ class TlsStorage`
`1089`	`1089`
`1090`	`1090`	`for(size_t i = 0; i < threads.size(); i++)`
`1091`	`1091`	`{`
`1092`		`- if(threads[i]->slots[slotIdx])`
	`1092`	`+ std::vector<void*>& thread_slots = threads[i]->slots;`
	`1093`	`+ if (thread_slots.size() > slotIdx && thread_slots[slotIdx])`
`1093`	`1094`	`{`
`1094`		`- dataVec.push_back(threads[i]->slots[slotIdx]);`
	`1095`	`+ dataVec.push_back(thread_slots[slotIdx]);`
`1095`	`1096`	`threads[i]->slots[slotIdx] = 0;`
`1096`	`1097`	`}`
`1097`	`1098`	`}`