CVE-2023-4154 replace: add ARRAY_INSERT_ELEMENT() helper

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15424

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
(cherry picked from commit 9d8ff0d1e0b2ba7c84af36e1931f5bc99902a44b)

diff --git a/lib/replace/replace.h b/lib/replace/replace.h
index b15f3d14c8a36336af7166a88016b480896b987e..25e6e145eebfc7c4e1d4b087063d1ab823cb5dd2 100644 (file)
--- a/lib/replace/replace.h
+++ b/lib/replace/replace.h
@@ -885,6 +885,21 @@ typedef unsigned long long ptrdiff_t ;
 #define ARRAY_DEL_ELEMENT(a,i,n) \
 if((i)<((n)-1)){memmove(&((a)[(i)]),&((a)[(i)+1]),(sizeof(*(a))*((n)-(i)-1)));}
 
+/**
+ * Insert an array element by moving the rest one up
+ *
+ */
+#define ARRAY_INSERT_ELEMENT(__array,__old_last_idx,__new_elem,__new_idx) do { \
+       if ((__new_idx) < (__old_last_idx)) { \
+               const void *__src = &((__array)[(__new_idx)]); \
+               void *__dst = &((__array)[(__new_idx)+1]); \
+               size_t __num = (__old_last_idx)-(__new_idx); \
+               size_t __len = sizeof(*(__array)) * __num; \
+               memmove(__dst, __src, __len); \
+       } \
+       (__array)[(__new_idx)] = (__new_elem); \
+} while(0)
+
 /**
  * Pointer difference macro
  */