{"action":"created","issue":{"url":"https://api.github.com/repos/retuxx/tinyspline/issues/17","labels_url":"https://api.github.com/repos/retuxx/tinyspline/issues/17/labels{/name}","comments_url":"https://api.github.com/repos/retuxx/tinyspline/issues/17/comments","events_url":"https://api.github.com/repos/retuxx/tinyspline/issues/17/events","html_url":"https://github.com/retuxx/tinyspline/issues/17","id":122448035,"number":17,"title":"ts_internal_bspline_thomas_algorithm have invalid access","user":{"login":"HaleXie","id":15898856,"avatar_url":"https://avatars.githubusercontent.com/u/15898856?v=3","gravatar_id":"","url":"https://api.github.com/users/HaleXie","html_url":"https://github.com/HaleXie","followers_url":"https://api.github.com/users/HaleXie/followers","following_url":"https://api.github.com/users/HaleXie/following{/other_user}","gists_url":"https://api.github.com/users/HaleXie/gists{/gist_id}","starred_url":"https://api.github.com/users/HaleXie/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/HaleXie/subscriptions","organizations_url":"https://api.github.com/users/HaleXie/orgs","repos_url":"https://api.github.com/users/HaleXie/repos","events_url":"https://api.github.com/users/HaleXie/events{/privacy}","received_events_url":"https://api.github.com/users/HaleXie/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/retuxx/tinyspline/labels/bug","name":"bug","color":"fc2929"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-12-16T07:49:59Z","updated_at":"2015-12-16T09:29:19Z","closed_at":null,"body":"The application could crash when using ts_bspline_interpolate() to interpolate a curve.\r\n\r\nThe code to access to variable 'm' in ts_internal_bspline_thomas_algorithm() has a buffer overflow\r\n\r\n\r\n /* m_0 = 1/4, m_{k+1} = 1/(4-m_k), for k = 0,...,n-2 */\r\n    const size_t len_m = n-2; /* n >= 3 implies n-2 >= 1 */\r\n    float* m = malloc(len_m*size_flt);\r\n    if (m == NULL)\r\n        return TS_MALLOC;\r\n    m[0] = 0.25f;\r\n    for (i = 1; i < len_m+1; i++)  //m[len_m+1] is an invalid memory address.\r\n        m[i] = 1.f/(4 - m[i-1]);\r\n"},"comment":{"url":"https://api.github.com/repos/retuxx/tinyspline/issues/comments/165045522","html_url":"https://github.com/retuxx/tinyspline/issues/17#issuecomment-165045522","issue_url":"https://api.github.com/repos/retuxx/tinyspline/issues/17","id":165045522,"user":{"login":"retuxx","id":317428,"avatar_url":"https://avatars.githubusercontent.com/u/317428?v=3","gravatar_id":"","url":"https://api.github.com/users/retuxx","html_url":"https://github.com/retuxx","followers_url":"https://api.github.com/users/retuxx/followers","following_url":"https://api.github.com/users/retuxx/following{/other_user}","gists_url":"https://api.github.com/users/retuxx/gists{/gist_id}","starred_url":"https://api.github.com/users/retuxx/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/retuxx/subscriptions","organizations_url":"https://api.github.com/users/retuxx/orgs","repos_url":"https://api.github.com/users/retuxx/repos","events_url":"https://api.github.com/users/retuxx/events{/privacy}","received_events_url":"https://api.github.com/users/retuxx/received_events","type":"User","site_admin":false},"created_at":"2015-12-16T09:29:19Z","updated_at":"2015-12-16T09:29:19Z","body":"Oh, you are right. Nice one, thanks!"}}