From cb0f7f373f55455d07f349f589ce3684d2fda167 Mon Sep 17 00:00:00 2001
From: Michael Drake <michael.drake@codethink.co.uk>
Date: Tue, 27 Jun 2017 10:50:06 +0100
Subject: Fix: Read beyond allocated memory when removing sheet from selection
 context.

Thanks to 'effin' on #netsurf.
---
 src/select/select.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'src/select/select.c')

diff --git a/src/select/select.c b/src/select/select.c
index f1c3637..580c29e 100644
--- a/src/select/select.c
+++ b/src/select/select.c
@@ -388,11 +388,11 @@ css_error css_select_ctx_remove_sheet(css_select_ctx *ctx,
 	if (index == ctx->n_sheets)
 		return CSS_INVALID;
 
+	ctx->n_sheets--;
+
 	memmove(&ctx->sheets[index], &ctx->sheets[index + 1],
 			(ctx->n_sheets - index) * sizeof(css_select_sheet));
 
-	ctx->n_sheets--;
-
 	return CSS_OK;
 
 }
-- 
cgit v1.2.3