fix memory corruption in deleteat! (#41646)

vtjnash · web-flow · commit 2e06a016fdad · 2021-07-21T12:15:12.000-04:00
n.b. `n == a->nrows + dec` Fixes JuliaData/DataFrames.jl#2819
diff --git a/src/array.c b/src/array.c
@@ -1119,7 +1119,7 @@ STATIC_INLINE void jl_array_del_at_beg(jl_array_t *a, size_t idx, size_t dec,
         // Move the rest of the data if the offset changed
         if (newoffs != offset) {
             memmove_safe(a->flags.hasptr, newdata + nb1, olddata + nb1 + nbdec, nbtotal - nb1);
-            if (isbitsunion) memmove(newtypetagdata + idx, typetagdata + idx + dec, n - idx);
+            if (isbitsunion) memmove(newtypetagdata + idx, typetagdata + idx + dec, a->nrows - idx);
         }
         a->data = newdata;
     }

Original file line number	Diff line number	Diff line change
`@@ -1119,7 +1119,7 @@ STATIC_INLINE void jl_array_del_at_beg(jl_array_t *a, size_t idx, size_t dec,`
`1119`	`1119`	`// Move the rest of the data if the offset changed`
`1120`	`1120`	`if (newoffs != offset) {`
`1121`	`1121`	`memmove_safe(a->flags.hasptr, newdata + nb1, olddata + nb1 + nbdec, nbtotal - nb1);`
`1122`		`- if (isbitsunion) memmove(newtypetagdata + idx, typetagdata + idx + dec, n - idx);`
	`1122`	`+ if (isbitsunion) memmove(newtypetagdata + idx, typetagdata + idx + dec, a->nrows - idx);`
`1123`	`1123`	`}`
`1124`	`1124`	`a->data = newdata;`
`1125`	`1125`	`}`