pppoe/disc: fix free_net memmove count and overlap handling

free_net() compacts the nets[] array by sliding entries left after
removing one:

    memcpy(nets + i, nets + i + 1, net_cnt - i - 1);

Two bugs:

  1. The count is a raw element count, not a byte count. nets[] holds
     'struct disc_net *' pointers, so only (net_cnt - i - 1) bytes are
     moved instead of (net_cnt - i - 1) * sizeof(nets[0]). On the usual
     8-byte-pointer build, 7 of every 8 surviving pointers are lost,
     leaving uninitialised holes in the array.

  2. Source and destination overlap (nets + i and nets + i + 1), so
     memcpy is undefined behaviour. The correct primitive is memmove.

Switch to memmove and multiply the count by sizeof(nets[0]).

Signed-off-by: khedor <khedor@gmail.com>

0 files changed, 0 insertions, 0 deletions