[Qt-interest] Analyze memory errors

[Stefan Löffler]

Hi,

I am confused as to the whether there actually is a problem in
QListData::append (as of git revision 88b541095). There, the memcpy() is
only invoked if
b - n >= 2 * d->alloc / 3
where b is the index of the first element, n is the number of elements
to add, and d->alloc is the array size (I assume).
Since n is (typically?) non-negative, this implies
b >= 2 * d->alloc / 3
Thus, the number of elements in the array, e-b, must be <= d->alloc / 3
(otherwise they would not have fit into the array in the first place).
Hence,
::memcpy(d->array, d->array + b, e * sizeof(void *));
can copy at most d->alloc / 3 elements from somewhere >= 2*d->alloc / 3
to the beginning of the array (so, into the range [0, d->alloc / 3]).
This doesn't sound like overlapping memory regions to me...

Of course, problems might arise with integer arithmetic for small
arrays... But generally, I don't see a problem here, or am I missing
something?

Could it be that memcpy() is called internally elsewhere?

Regards,
Stefan