From: Nick Terrell <terrelln@fb.com>
Date: Tue, 21 Jul 2015 18:34:55 +0000 (-0700)
Subject: Add bounds check in get_ptr.
X-Git-Tag: v0.52.0~15
X-Git-Url: http://plrg.eecs.uci.edu/git/?a=commitdiff_plain;h=c636ccbe85cd086426dceb645dca71e7dc1d7efd;p=folly.git

Add bounds check in get_ptr.

Summary: `get_ptr()` checks if the index is past the end of the array, but it
doesn't check if it is less than 0, while `at()` does.

Reviewed By: @yfeldblum

Differential Revision: D2258548
---

diff --git a/folly/dynamic.cpp b/folly/dynamic.cpp
index 840c5f33..e5829244 100644
--- a/folly/dynamic.cpp
+++ b/folly/dynamic.cpp
@@ -165,7 +165,7 @@ const dynamic* dynamic::get_ptr(dynamic const& idx) const {
     if (!idx.isInt()) {
       throw TypeError("int64", idx.type());
     }
-    if (idx >= parray->size()) {
+    if (idx < 0 || idx >= parray->size()) {
       return nullptr;
     }
     return &(*parray)[idx.asInt()];
diff --git a/folly/test/DynamicTest.cpp b/folly/test/DynamicTest.cpp
index e471d021..184d57f4 100644
--- a/folly/test/DynamicTest.cpp
+++ b/folly/test/DynamicTest.cpp
@@ -269,6 +269,7 @@ TEST(Dynamic, ObjectForwarding) {
 TEST(Dynamic, GetPtr) {
   dynamic array = { 1, 2, "three" };
   EXPECT_TRUE(array.get_ptr(0));
+  EXPECT_FALSE(array.get_ptr(-1));
   EXPECT_FALSE(array.get_ptr(3));
   EXPECT_EQ(dynamic("three"), *array.get_ptr(2));
   const dynamic& carray = array;